.forgejo/workflows/builds.yml

@@ -18,6 +18,3 @@ jobs:
 
       - name: Build binary
         run: make
-
-      - name: Check dirty suffix
-        run: if [[ $(make version) == *"dirty"* ]]; then echo "Version has dirty suffix" && exit 1; fi

.forgejo/workflows/dco.yml

@@ -15,6 +15,6 @@ jobs:
           go-version: '1.21'
 
       - name: Run commit format checker
-        uses: https://git.frostfs.info/TrueCloudLab/dco-go@v3
+        uses: https://git.frostfs.info/TrueCloudLab/dco-go@v1
         with:
-          from: 'origin/${{ github.event.pull_request.base.ref }}'
+          from: 3fbad97a

CHANGELOG.md

@@ -4,50 +4,6 @@ This document outlines major changes between releases.
 
 ## [Unreleased]
 
-### Fixed
-- Fix marshaling errors in `DeleteObjects` method (#222)
-- Fix status code in GET/HEAD delete marker (#226)
-- Fix `NextVersionIDMarker` in `list-object-versions` (#248)
-- Fix possibility of panic during SIGHUP (#288)
-
-### Added
-- Add new `frostfs.buffer_max_size_for_put` config param and sync TZ hash for PUT operations (#197)
-- Add `X-Amz-Version-Id` header after complete multipart upload (#227)
-- Add handling of `X-Amz-Copy-Source-Server-Side-Encryption-Customer-*` headers during copy (#217)
-- Add new `logger.destination` config param (#236)
-- Add `X-Amz-Content-Sha256` header validation (#218)
-- Support frostfsid contract. See `frostfsid` config section (#260)
-- Support per namespace placement policies configuration (see `namespaces.config` config param) (#266)
-- Support control api to manage policies. See `control` config section (#258)
-- Add `namespace` label to billing metrics (#271)
-- Support policy-engine (#257)
-- Support `policy` contract (#259)
-- Support `proxy` contract (#287)
-- Authmate: support custom attributes (#292)
-
-### Changed
-- Generalise config param `use_default_xmlns_for_complete_multipart` to `use_default_xmlns` so that use default xmlns for all requests (#221)
-- Set server IdleTimeout and ReadHeaderTimeout to `30s` and allow to configure them (#220)
-- Return `ETag` value in quotes (#219)
-- Use tombstone when delete multipart upload (#275)
-- Support new parameter `cache.accessbox.removing_check_interval` (#XX)
-
-### Removed
-- Drop sending whitespace characters during complete multipart upload and related config param `kludge.complete_multipart_keepalive` (#227)
-
-## [0.28.1] - 2024-01-24
-
-### Added
-- MD5 hash as ETag and response header (#205)
-- Tree pool traversal limit (#262)
-
-### Updating from 0.28.0
-
-See new `features.md5.enabled` and `frostfs.tree_pool_max_attempts` config
-parameters.
-
-## [0.28.0] - Academy of Sciences - 2023-12-07
-
 ### Fixed
 - Handle negative `Content-Length` on put (#125)
 - Use `DisableURIPathEscaping` to presign urls (#125)
@@ -57,17 +13,17 @@ parameters.
 - Replace part on re-upload when use multipart upload (#176)
 - Fix goroutine leak on put object error (#178)
 - Fix parsing signed headers in presigned urls (#182)
-- Fix url escaping (#188)
+- Fix url escaping (#188, #224)
 - Use correct keys in `list-multipart-uploads` response (#185)
-- Fix parsing `key-marker` for object list versions (#237)
-- `GetSubTree` failures (#179)
-- Unexpected EOF during multipart download (#210)
-- Produce clean version in debian build (#245)
+- Fix parsing `key-marker` for object list versions (#243)
+- Fix marshaling errors in `DeleteObjects` method (#222)
+- Fix status code in GET/HEAD delete marker (#226)
+- Fix `NextVersionIDMarker` in `list-object-versions` (#248)
 
 ### Added
 - Add `trace_id` value into log record when tracing is enabled (#142)
 - Add basic error types and exit codes to `frostfs-s3-authmate` (#152)
-- Add a metric with addresses of nodes of the same and highest priority that are currently healthy (#186)
+- Add a metric with addresses of nodes of the same and highest priority that are currently healthy (#51)
 - Support dump metrics descriptions (#80)
 - Add `copies_numbers` section to `placement_policy` in config file and support vectors of copies numbers (#70, #101)
 - Support impersonate bearer token (#81, #105)
@@ -78,9 +34,10 @@ parameters.
 - Implement chunk uploading (#106)
 - Add new `kludge.bypass_content_encoding_check_in_chunks` config param (#146)
 - Add new `frostfs.client_cut` config param (#192)
-- Add selection of the node of the latest version of the object (#231)
-- Soft memory limit with `runtime.soft_memory_limit` (#196)
-- `server_health` metric for every S3 endpoint status (#199)
+- Add new `frostfs.buffer_max_size_for_put` config param and sync TZ hash for PUT operations (#197)
+- Add `X-Amz-Version-Id` header after complete multipart upload (#227)
+- Add handling of `X-Amz-Copy-Source-Server-Side-Encryption-Customer-*` headers during copy (#217)
+- Add new `logger.destination` config param (#236)
 
 ### Changed
 - Update prometheus to v1.15.0 (#94)
@@ -91,19 +48,16 @@ parameters.
 - Use request scope logger (#111)
 - Add `s3-authmate update-secret` command (#131)
 - Use default registerer for app metrics (#155)
-- Use chi router instead of archived gorlilla/mux (#149, #174, #188)
+- Use chi router instead of archived gorlilla/mux (#149)
 - Complete multipart upload doesn't unnecessary copy now. Thus, the total time of multipart upload was reduced by 2 times (#63)
 - Use gate key to form object owner (#175)
 - Apply placement policies and copies if there is at least one valid value (#168)
-- `statistic_tx_bytes_total` and `statistic_rx_bytes_total` metric to `statistic_bytes_total` metric with `direction` label (#153)
-- Refactor of context-stored data receivers (#137)
-- Refactor fetch/parse config parameters functions (#117)
-- Move all log messages to constants (#96)
-- Allow zero value of `part-number-marker` (#207)
-- Clean tag node in the tree service instead of removal (#233)
+- Generalise config param `use_default_xmlns_for_complete_multipart` to `use_default_xmlns` so that use default xmlns for all requests (#221)
+- Set server IdleTimeout and ReadHeaderTimeout to `30s` and allow to configure them (#220)
 
 ### Removed
 - Drop `tree.service` param (now endpoints from `peers` section are used) (#133)
+- Drop sending whitespace characters during complete multipart upload and related config param `kludge.complete_multipart_keepalive` (#227)
 
 ## [0.27.0] - Karpinsky - 2023-07-12
 
@@ -149,6 +103,4 @@ This project is a fork of [NeoFS S3 Gateway](https://github.com/nspcc-dev/neofs-
 To see CHANGELOG for older versions, refer to https://github.com/nspcc-dev/neofs-s3-gw/blob/master/CHANGELOG.md.
 
 [0.27.0]: https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/compare/b2148cc3...v0.27.0
-[0.28.0]: https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/compare/v0.27.0...v0.28.0
-[0.28.1]: https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/compare/v0.28.0...v0.28.1
-[Unreleased]: https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/compare/v0.28.1...master
+[Unreleased]: https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/compare/v0.27.0...master

Makefile

@@ -151,16 +151,10 @@ clean:
 
 # Generate code from .proto files
 protoc:
-	# Install specific version for protobuf lib
-	@GOBIN=$(abspath $(BINDIR)) go install -mod=mod -v git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/util/protogen
 	@for f in `find . -type f -name '*.proto' -not -path './vendor/*'`; do \
 		echo "⇒ Processing $$f "; \
 		protoc \
-			--go_out=paths=source_relative:. \
-            --plugin=protoc-gen-go-frostfs=$(BINDIR)/protogen \
-            --go-frostfs_out=. --go-frostfs_opt=paths=source_relative \
-            --go-grpc_opt=require_unimplemented_servers=false \
-            --go-grpc_out=. --go-grpc_opt=paths=source_relative $$f; \
+			--go_out=paths=source_relative:. $$f; \
 	done
 	rm -rf vendor
 

VERSION

@@ -1 +1 @@
-v0.28.1
+v0.27.0

api/auth/center.go

@@ -5,6 +5,7 @@ import (
 	"crypto/hmac"
 	"crypto/sha256"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"io"
 	"mime/multipart"
@@ -14,12 +15,13 @@ import (
 	"time"
 
 	v4 "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/auth/signer/v4"
+	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/cache"
 	apiErrors "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/middleware"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/creds/accessbox"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/creds/tokens"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 )
 
 // authorizationFieldRegexp -- is regexp for credentials with Base58 encoded cid and oid and '0' (zero) as delimiter.
@@ -29,13 +31,27 @@ var authorizationFieldRegexp = regexp.MustCompile(`AWS4-HMAC-SHA256 Credential=(
 var postPolicyCredentialRegexp = regexp.MustCompile(`(?P<access_key_id>[^/]+)/(?P<date>[^/]+)/(?P<region>[^/]*)/(?P<service>[^/]+)/aws4_request`)
 
 type (
-	Center struct {
+	// Center is a user authentication interface.
+	Center interface {
+		Authenticate(request *http.Request) (*Box, error)
+	}
+
+	// Box contains access box and additional info.
+	Box struct {
+		AccessBox   *accessbox.Box
+		ClientTime  time.Time
+		AuthHeaders *AuthHeader
+	}
+
+	center struct {
 		reg                        *RegexpSubmatcher
 		postReg                    *RegexpSubmatcher
 		cli                        tokens.Credentials
 		allowedAccessKeyIDPrefixes []string // empty slice means all access key ids are allowed
 	}
 
+	prs int
+
 	//nolint:revive
 	AuthHeader struct {
 		AccessKeyID  string
@@ -60,38 +76,34 @@ const (
 	AmzSignedHeaders = "X-Amz-SignedHeaders"
 	AmzExpires       = "X-Amz-Expires"
 	AmzDate          = "X-Amz-Date"
-	AmzContentSHA256 = "X-Amz-Content-Sha256"
 	AuthorizationHdr = "Authorization"
 	ContentTypeHdr   = "Content-Type"
-
-	UnsignedPayload                    = "UNSIGNED-PAYLOAD"
-	StreamingUnsignedPayloadTrailer    = "STREAMING-UNSIGNED-PAYLOAD-TRAILER"
-	StreamingContentSHA256             = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD"
-	StreamingContentSHA256Trailer      = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER"
-	StreamingContentECDSASHA256        = "STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD"
-	StreamingContentECDSASHA256Trailer = "STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD-TRAILER"
 )
 
-var ContentSHA256HeaderStandardValue = map[string]struct{}{
-	UnsignedPayload:                    {},
-	StreamingUnsignedPayloadTrailer:    {},
-	StreamingContentSHA256:             {},
-	StreamingContentSHA256Trailer:      {},
-	StreamingContentECDSASHA256:        {},
-	StreamingContentECDSASHA256Trailer: {},
+// ErrNoAuthorizationHeader is returned for unauthenticated requests.
+var ErrNoAuthorizationHeader = errors.New("no authorization header")
+
+func (p prs) Read(_ []byte) (n int, err error) {
+	panic("implement me")
 }
 
+func (p prs) Seek(_ int64, _ int) (int64, error) {
+	panic("implement me")
+}
+
+var _ io.ReadSeeker = prs(0)
+
 // New creates an instance of AuthCenter.
-func New(creds tokens.Credentials, prefixes []string) *Center {
-	return &Center{
-		cli:                        creds,
+func New(frostFS tokens.FrostFS, key *keys.PrivateKey, prefixes []string, config *cache.Config) Center {
+	return &center{
+		cli:                        tokens.New(frostFS, key, config),
 		reg:                        NewRegexpMatcher(authorizationFieldRegexp),
 		postReg:                    NewRegexpMatcher(postPolicyCredentialRegexp),
 		allowedAccessKeyIDPrefixes: prefixes,
 	}
 }
 
-func (c *Center) parseAuthHeader(header string) (*AuthHeader, error) {
+func (c *center) parseAuthHeader(header string) (*AuthHeader, error) {
 	submatches := c.reg.GetSubmatches(header)
 	if len(submatches) != authHeaderPartsNum {
 		return nil, apiErrors.GetAPIError(apiErrors.ErrAuthorizationHeaderMalformed)
@@ -122,12 +134,7 @@ func (a *AuthHeader) getAddress() (oid.Address, error) {
 	return addr, nil
 }
 
-func IsStandardContentSHA256(key string) bool {
-	_, ok := ContentSHA256HeaderStandardValue[key]
-	return ok
-}
-
-func (c *Center) Authenticate(r *http.Request) (*middleware.Box, error) {
+func (c *center) Authenticate(r *http.Request) (*Box, error) {
 	var (
 		err                  error
 		authHdr              *AuthHeader
@@ -161,7 +168,7 @@ func (c *Center) Authenticate(r *http.Request) (*middleware.Box, error) {
 			if strings.HasPrefix(r.Header.Get(ContentTypeHdr), "multipart/form-data") {
 				return c.checkFormData(r)
 			}
-			return nil, middleware.ErrNoAuthorizationHeader
+			return nil, ErrNoAuthorizationHeader
 		}
 		authHdr, err = c.parseAuthHeader(authHeaderField[0])
 		if err != nil {
@@ -190,22 +197,14 @@ func (c *Center) Authenticate(r *http.Request) (*middleware.Box, error) {
 		return nil, fmt.Errorf("get box: %w", err)
 	}
 
-	if err = checkFormatHashContentSHA256(r.Header.Get(AmzContentSHA256)); err != nil {
-		return nil, err
-	}
-
 	clonedRequest := cloneRequest(r, authHdr)
 	if err = c.checkSign(authHdr, box, clonedRequest, signatureDateTime); err != nil {
 		return nil, err
 	}
 
-	result := &middleware.Box{
-		AccessBox: box,
-		AuthHeaders: &middleware.AuthHeader{
-			AccessKeyID: authHdr.AccessKeyID,
-			Region:      authHdr.Region,
-			SignatureV4: authHdr.SignatureV4,
-		},
+	result := &Box{
+		AccessBox:   box,
+		AuthHeaders: authHdr,
 	}
 	if needClientTime {
 		result.ClientTime = signatureDateTime
@@ -214,21 +213,7 @@ func (c *Center) Authenticate(r *http.Request) (*middleware.Box, error) {
 	return result, nil
 }
 
-func checkFormatHashContentSHA256(hash string) error {
-	if !IsStandardContentSHA256(hash) {
-		hashBinary, err := hex.DecodeString(hash)
-		if err != nil {
-			return apiErrors.GetAPIError(apiErrors.ErrContentSHA256Mismatch)
-		}
-		if len(hashBinary) != sha256.Size && len(hash) != 0 {
-			return apiErrors.GetAPIError(apiErrors.ErrContentSHA256Mismatch)
-		}
-	}
-
-	return nil
-}
-
-func (c Center) checkAccessKeyID(accessKeyID string) error {
+func (c center) checkAccessKeyID(accessKeyID string) error {
 	if len(c.allowedAccessKeyIDPrefixes) == 0 {
 		return nil
 	}
@@ -242,7 +227,7 @@ func (c Center) checkAccessKeyID(accessKeyID string) error {
 	return apiErrors.GetAPIError(apiErrors.ErrAccessDenied)
 }
 
-func (c *Center) checkFormData(r *http.Request) (*middleware.Box, error) {
+func (c *center) checkFormData(r *http.Request) (*Box, error) {
 	if err := r.ParseMultipartForm(maxFormSizeMemory); err != nil {
 		return nil, apiErrors.GetAPIError(apiErrors.ErrInvalidArgument)
 	}
@@ -253,7 +238,7 @@ func (c *Center) checkFormData(r *http.Request) (*middleware.Box, error) {
 
 	policy := MultipartFormValue(r, "policy")
 	if policy == "" {
-		return nil, middleware.ErrNoAuthorizationHeader
+		return nil, ErrNoAuthorizationHeader
 	}
 
 	submatches := c.postReg.GetSubmatches(MultipartFormValue(r, "x-amz-credential"))
@@ -284,7 +269,7 @@ func (c *Center) checkFormData(r *http.Request) (*middleware.Box, error) {
 		return nil, apiErrors.GetAPIError(apiErrors.ErrSignatureDoesNotMatch)
 	}
 
-	return &middleware.Box{AccessBox: box}, nil
+	return &Box{AccessBox: box}, nil
 }
 
 func cloneRequest(r *http.Request, authHeader *AuthHeader) *http.Request {
@@ -308,7 +293,7 @@ func cloneRequest(r *http.Request, authHeader *AuthHeader) *http.Request {
 	return otherRequest
 }
 
-func (c *Center) checkSign(authHeader *AuthHeader, box *accessbox.Box, request *http.Request, signatureDateTime time.Time) error {
+func (c *center) checkSign(authHeader *AuthHeader, box *accessbox.Box, request *http.Request, signatureDateTime time.Time) error {
 	awsCreds := credentials.NewStaticCredentials(authHeader.AccessKeyID, box.Gate.SecretKey, "")
 	signer := v4.NewSigner(awsCreds)
 	signer.DisableURIPathEscaping = true

api/auth/center_test.go

@@ -12,7 +12,7 @@ import (
 func TestAuthHeaderParse(t *testing.T) {
 	defaultHeader := "AWS4-HMAC-SHA256 Credential=oid0cid/20210809/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=2811ccb9e242f41426738fb1f"
 
-	center := &Center{
+	center := &center{
 		reg: NewRegexpMatcher(authorizationFieldRegexp),
 	}
 
@@ -99,49 +99,3 @@ func TestSignature(t *testing.T) {
 	signature := signStr(secret, "s3", "us-east-1", signTime, strToSign)
 	require.Equal(t, "dfbe886241d9e369cf4b329ca0f15eb27306c97aa1022cc0bb5a914c4ef87634", signature)
 }
-
-func TestCheckFormatContentSHA256(t *testing.T) {
-	defaultErr := errors.GetAPIError(errors.ErrContentSHA256Mismatch)
-
-	for _, tc := range []struct {
-		name  string
-		hash  string
-		error error
-	}{
-		{
-			name:  "invalid hash format: length and character",
-			hash:  "invalid-hash",
-			error: defaultErr,
-		},
-		{
-			name:  "invalid hash format: length (63 characters)",
-			hash:  "ed7002b439e9ac845f22357d822bac1444730fbdb6016d3ec9432297b9ec9f7",
-			error: defaultErr,
-		},
-		{
-			name:  "invalid hash format: character",
-			hash:  "ed7002b439e9ac845f22357d822bac1444730fbdb6016d3ec9432297b9ec9f7s",
-			error: defaultErr,
-		},
-		{
-			name:  "unsigned payload",
-			hash:  "UNSIGNED-PAYLOAD",
-			error: nil,
-		},
-		{
-			name:  "no hash",
-			hash:  "",
-			error: nil,
-		},
-		{
-			name:  "correct hash format",
-			hash:  "ed7002b439e9ac845f22357d822bac1444730fbdb6016d3ec9432297b9ec9f73",
-			error: nil,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			err := checkFormatHashContentSHA256(tc.hash)
-			require.Equal(t, tc.error, err)
-		})
-	}
-}

api/auth/presign_test.go

@@ -11,7 +11,9 @@ import (
 	apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
 	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"github.com/stretchr/testify/require"
 )
 
@@ -40,11 +42,11 @@ func (m credentialsMock) GetBox(_ context.Context, addr oid.Address) (*accessbox
 	return box, nil
 }
 
-func (m credentialsMock) Put(context.Context, cid.ID, tokens.CredentialsParam) (oid.Address, error) {
+func (m credentialsMock) Put(context.Context, cid.ID, user.ID, *accessbox.AccessBox, uint64, ...*keys.PublicKey) (oid.Address, error) {
 	return oid.Address{}, nil
 }
 
-func (m credentialsMock) Update(context.Context, oid.Address, tokens.CredentialsParam) (oid.Address, error) {
+func (m credentialsMock) Update(context.Context, oid.Address, user.ID, *accessbox.AccessBox, uint64, ...*keys.PublicKey) (oid.Address, error) {
 	return oid.Address{}, nil
 }
 
@@ -82,7 +84,7 @@ func TestCheckSign(t *testing.T) {
 	mock := newTokensFrostfsMock()
 	mock.addBox(accessKeyAddr, expBox)
 
-	c := &Center{
+	c := &center{
 		cli:     mock,
 		reg:     NewRegexpMatcher(authorizationFieldRegexp),
 		postReg: NewRegexpMatcher(postPolicyCredentialRegexp),

api/cache/accessbox.go

@@ -24,11 +24,6 @@ type (
 		Lifetime time.Duration
 		Logger   *zap.Logger
 	}
-
-	AccessBoxCacheValue struct {
-		Box     *accessbox.Box
-		PutTime time.Time
-	}
 )
 
 const (
@@ -47,21 +42,21 @@ func DefaultAccessBoxConfig(logger *zap.Logger) *Config {
 	}
 }
 
-// NewAccessBoxCache creates an object of AccessBoxCache.
+// NewAccessBoxCache creates an object of BucketCache.
 func NewAccessBoxCache(config *Config) *AccessBoxCache {
 	gc := gcache.New(config.Size).LRU().Expiration(config.Lifetime).Build()
 
 	return &AccessBoxCache{cache: gc, logger: config.Logger}
 }
 
-// Get returns a cached accessbox.
-func (o *AccessBoxCache) Get(address oid.Address) *AccessBoxCacheValue {
+// Get returns a cached object.
+func (o *AccessBoxCache) Get(address oid.Address) *accessbox.Box {
 	entry, err := o.cache.Get(address)
 	if err != nil {
 		return nil
 	}
 
-	result, ok := entry.(*AccessBoxCacheValue)
+	result, ok := entry.(*accessbox.Box)
 	if !ok {
 		o.logger.Warn(logs.InvalidCacheEntryType, zap.String("actual", fmt.Sprintf("%T", entry)),
 			zap.String("expected", fmt.Sprintf("%T", result)))
@@ -71,16 +66,7 @@ func (o *AccessBoxCache) Get(address oid.Address) *AccessBoxCacheValue {
 	return result
 }
 
-// Put stores an accessbox to cache.
+// Put stores an object to cache.
 func (o *AccessBoxCache) Put(address oid.Address, box *accessbox.Box) error {
-	val := &AccessBoxCacheValue{
-		Box:     box,
-		PutTime: time.Now(),
-	}
-	return o.cache.Set(address, val)
-}
-
-// Delete removes an accessbox from cache.
-func (o *AccessBoxCache) Delete(address oid.Address) {
-	o.cache.Remove(address)
+	return o.cache.Set(address, box)
 }

api/cache/buckets.go

@@ -39,8 +39,8 @@ func NewBucketCache(config *Config) *BucketCache {
 }
 
 // Get returns a cached object.
-func (o *BucketCache) Get(ns, bktName string) *data.BucketInfo {
-	entry, err := o.cache.Get(formKey(ns, bktName))
+func (o *BucketCache) Get(key string) *data.BucketInfo {
+	entry, err := o.cache.Get(key)
 	if err != nil {
 		return nil
 	}
@@ -57,14 +57,10 @@ func (o *BucketCache) Get(ns, bktName string) *data.BucketInfo {
 
 // Put puts an object to cache.
 func (o *BucketCache) Put(bkt *data.BucketInfo) error {
-	return o.cache.Set(formKey(bkt.Zone, bkt.Name), bkt)
+	return o.cache.Set(bkt.Name, bkt)
 }
 
 // Delete deletes an object from cache.
-func (o *BucketCache) Delete(bkt *data.BucketInfo) bool {
-	return o.cache.Remove(formKey(bkt.Zone, bkt.Name))
-}
-
-func formKey(ns, name string) string {
-	return name + "." + ns
+func (o *BucketCache) Delete(key string) bool {
+	return o.cache.Remove(key)
 }

api/cache/cache_test.go

@@ -22,7 +22,7 @@ func TestAccessBoxCacheType(t *testing.T) {
 	err := cache.Put(addr, box)
 	require.NoError(t, err)
 	val := cache.Get(addr)
-	require.Equal(t, box, val.Box)
+	require.Equal(t, box, val)
 	require.Equal(t, 0, observedLog.Len())
 
 	err = cache.cache.Set(addr, "tmp")
@@ -38,13 +38,13 @@ func TestBucketsCacheType(t *testing.T) {
 
 	err := cache.Put(bktInfo)
 	require.NoError(t, err)
-	val := cache.Get("", bktInfo.Name)
+	val := cache.Get(bktInfo.Name)
 	require.Equal(t, bktInfo, val)
 	require.Equal(t, 0, observedLog.Len())
 
-	err = cache.cache.Set(bktInfo.Name+"."+bktInfo.Zone, "tmp")
+	err = cache.cache.Set(bktInfo.Name, "tmp")
 	require.NoError(t, err)
-	assertInvalidCacheEntry(t, cache.Get(bktInfo.Zone, bktInfo.Name), observedLog)
+	assertInvalidCacheEntry(t, cache.Get(bktInfo.Name), observedLog)
 }
 
 func TestObjectNamesCacheType(t *testing.T) {

api/cache/listsession.go

@@ -1,107 +0,0 @@
-package cache
-
-import (
-	"fmt"
-	"time"
-
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
-	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
-	"github.com/bluele/gcache"
-	"go.uber.org/zap"
-)
-
-type (
-	// ListSessionCache contains cache for list session (during pagination).
-	ListSessionCache struct {
-		cache  gcache.Cache
-		logger *zap.Logger
-	}
-
-	// ListSessionKey is a key to find a ListSessionCache's entry.
-	ListSessionKey struct {
-		cid    cid.ID
-		prefix string
-		token  string
-	}
-)
-
-const (
-	// DefaultListSessionCacheLifetime is a default lifetime of entries in cache of ListObjects.
-	DefaultListSessionCacheLifetime = time.Second * 60
-	// DefaultListSessionCacheSize is a default size of cache of ListObjects.
-	DefaultListSessionCacheSize = 100
-)
-
-// DefaultListSessionConfig returns new default cache expiration values.
-func DefaultListSessionConfig(logger *zap.Logger) *Config {
-	return &Config{
-		Size:     DefaultListSessionCacheSize,
-		Lifetime: DefaultListSessionCacheLifetime,
-		Logger:   logger,
-	}
-}
-
-func (k *ListSessionKey) String() string {
-	return k.cid.EncodeToString() + k.prefix + k.token
-}
-
-// NewListSessionCache is a constructor which creates an object of ListObjectsCache with the given lifetime of entries.
-func NewListSessionCache(config *Config) *ListSessionCache {
-	gc := gcache.New(config.Size).LRU().Expiration(config.Lifetime).EvictedFunc(func(key interface{}, val interface{}) {
-		session, ok := val.(*data.ListSession)
-		if !ok {
-			config.Logger.Warn(logs.InvalidCacheEntryType, zap.String("actual", fmt.Sprintf("%T", val)),
-				zap.String("expected", fmt.Sprintf("%T", session)))
-		}
-
-		if !session.Acquired.Load() {
-			session.Cancel()
-		}
-	}).Build()
-	return &ListSessionCache{cache: gc, logger: config.Logger}
-}
-
-// GetListSession returns a list of ObjectInfo.
-func (l *ListSessionCache) GetListSession(key ListSessionKey) *data.ListSession {
-	entry, err := l.cache.Get(key)
-	if err != nil {
-		return nil
-	}
-
-	result, ok := entry.(*data.ListSession)
-	if !ok {
-		l.logger.Warn(logs.InvalidCacheEntryType, zap.String("actual", fmt.Sprintf("%T", entry)),
-			zap.String("expected", fmt.Sprintf("%T", result)))
-		return nil
-	}
-
-	return result
-}
-
-// PutListSession puts a list of object versions to cache.
-func (l *ListSessionCache) PutListSession(key ListSessionKey, session *data.ListSession) error {
-	s := l.GetListSession(key)
-	if s != nil && s != session {
-		if !s.Acquired.Load() {
-			s.Cancel()
-		}
-	}
-	return l.cache.Set(key, session)
-}
-
-// DeleteListSession removes key from cache.
-func (l *ListSessionCache) DeleteListSession(key ListSessionKey) {
-	l.cache.Remove(key)
-}
-
-// CreateListSessionCacheKey returns ListSessionKey with the given CID, prefix and token.
-func CreateListSessionCacheKey(cnr cid.ID, prefix, token string) ListSessionKey {
-	p := ListSessionKey{
-		cid:    cnr,
-		prefix: prefix,
-		token:  token,
-	}
-
-	return p
-}

api/cache/policy.go

@@ -1,72 +0,0 @@
-package cache
-
-import (
-	"fmt"
-	"time"
-
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
-	"github.com/bluele/gcache"
-	"go.uber.org/zap"
-)
-
-// MorphPolicyCache provides lru cache for listing policies stored in policy contract.
-type MorphPolicyCache struct {
-	cache  gcache.Cache
-	logger *zap.Logger
-}
-
-type MorphPolicyCacheKey struct {
-	Target engine.Target
-	Name   chain.Name
-}
-
-const (
-	// DefaultMorphPolicyCacheSize is a default maximum number of entries in cache.
-	DefaultMorphPolicyCacheSize = 1e4
-	// DefaultMorphPolicyCacheLifetime is a default lifetime of entries in cache.
-	DefaultMorphPolicyCacheLifetime = time.Minute
-)
-
-// DefaultMorphPolicyConfig returns new default cache expiration values.
-func DefaultMorphPolicyConfig(logger *zap.Logger) *Config {
-	return &Config{
-		Size:     DefaultMorphPolicyCacheSize,
-		Lifetime: DefaultMorphPolicyCacheLifetime,
-		Logger:   logger,
-	}
-}
-
-// NewMorphPolicyCache creates an object of MorphPolicyCache.
-func NewMorphPolicyCache(config *Config) *MorphPolicyCache {
-	gc := gcache.New(config.Size).LRU().Expiration(config.Lifetime).Build()
-	return &MorphPolicyCache{cache: gc, logger: config.Logger}
-}
-
-// Get returns a cached object. Returns nil if value is missing.
-func (o *MorphPolicyCache) Get(key MorphPolicyCacheKey) []*chain.Chain {
-	entry, err := o.cache.Get(key)
-	if err != nil {
-		return nil
-	}
-
-	result, ok := entry.([]*chain.Chain)
-	if !ok {
-		o.logger.Warn(logs.InvalidCacheEntryType, zap.String("actual", fmt.Sprintf("%T", entry)),
-			zap.String("expected", fmt.Sprintf("%T", result)))
-		return nil
-	}
-
-	return result
-}
-
-// Put puts an object to cache.
-func (o *MorphPolicyCache) Put(key MorphPolicyCacheKey, list []*chain.Chain) error {
-	return o.cache.Set(key, list)
-}
-
-// Delete deletes an object from cache.
-func (o *MorphPolicyCache) Delete(key MorphPolicyCacheKey) bool {
-	return o.cache.Remove(key)
-}

api/data/info.go

@@ -2,7 +2,6 @@ package data
 
 import (
 	"encoding/xml"
-	"strings"
 	"time"
 
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
@@ -35,8 +34,10 @@ type (
 
 	// ObjectInfo holds S3 object data.
 	ObjectInfo struct {
-		ID  oid.ID
-		CID cid.ID
+		ID             oid.ID
+		CID            cid.ID
+		IsDir          bool
+		IsDeleteMarker bool
 
 		Bucket        string
 		Name          string
@@ -82,12 +83,12 @@ type (
 )
 
 // NotificationInfoFromObject creates new NotificationInfo from ObjectInfo.
-func NotificationInfoFromObject(objInfo *ObjectInfo, md5Enabled bool) *NotificationInfo {
+func NotificationInfoFromObject(objInfo *ObjectInfo) *NotificationInfo {
 	return &NotificationInfo{
 		Name:    objInfo.Name,
 		Version: objInfo.VersionID(),
 		Size:    objInfo.Size,
-		HashSum: Quote(objInfo.ETag(md5Enabled)),
+		HashSum: objInfo.HashSum,
 	}
 }
 
@@ -134,11 +135,3 @@ func (b BucketSettings) VersioningEnabled() bool {
 func (b BucketSettings) VersioningSuspended() bool {
 	return b.Versioning == VersioningSuspended
 }
-
-func Quote(val string) string {
-	return "\"" + val + "\""
-}
-
-func UnQuote(val string) string {
-	return strings.Trim(val, "\"")
-}

api/data/listsession.go

@@ -1,19 +0,0 @@
-package data
-
-import (
-	"context"
-	"sync/atomic"
-)
-
-type VersionsStream interface {
-	Next(ctx context.Context) (*NodeVersion, error)
-}
-
-type ListSession struct {
-	Next     []*ExtendedNodeVersion
-	Stream   VersionsStream
-	NamesMap map[string]struct{}
-	Context  context.Context
-	Cancel   context.CancelFunc
-	Acquired atomic.Bool
-}

api/data/tree.go

@@ -16,31 +16,20 @@ const (
 // NodeVersion represent node from tree service.
 type NodeVersion struct {
 	BaseNodeVersion
+	DeleteMarker  *DeleteMarkerInfo
 	IsUnversioned bool
 	IsCombined    bool
 }
 
-// ExtendedNodeVersion contains additional node info to be able to sort versions by timestamp.
-type ExtendedNodeVersion struct {
-	NodeVersion *NodeVersion
-	IsLatest    bool
-	DirName     string
+func (v NodeVersion) IsDeleteMarker() bool {
+	return v.DeleteMarker != nil
 }
 
-func (e ExtendedNodeVersion) Version() string {
-	if e.NodeVersion.IsUnversioned {
-		return UnversionedObjectVersionID
-	}
-
-	return e.NodeVersion.OID.EncodeToString()
-}
-
-func (e ExtendedNodeVersion) Name() string {
-	if e.DirName != "" {
-		return e.DirName
-	}
-
-	return e.NodeVersion.FilePath
+// DeleteMarkerInfo is used to save object info if node in the tree service is delete marker.
+// We need this information because the "delete marker" object is no longer stored in FrostFS.
+type DeleteMarkerInfo struct {
+	Created time.Time
+	Owner   user.ID
 }
 
 // ExtendedObjectInfo contains additional node info to be able to sort versions by timestamp.
@@ -61,35 +50,14 @@ func (e ExtendedObjectInfo) Version() string {
 // BaseNodeVersion is minimal node info from tree service.
 // Basically used for "system" object.
 type BaseNodeVersion struct {
-	ID             uint64
-	ParenID        uint64
-	OID            oid.ID
-	Timestamp      uint64
-	Size           uint64
-	ETag           string
-	MD5            string
-	FilePath       string
-	Created        *time.Time
-	Owner          *user.ID
-	IsDeleteMarker bool
-}
-
-func (v *BaseNodeVersion) GetETag(md5Enabled bool) string {
-	if md5Enabled && len(v.MD5) > 0 {
-		return v.MD5
-	}
-	return v.ETag
-}
-
-// IsFilledExtra returns true is node was created by version of gate v0.29.x and later.
-func (v BaseNodeVersion) IsFilledExtra() bool {
-	return v.Created != nil && v.Owner != nil
-}
-
-func (v *BaseNodeVersion) FillExtra(owner *user.ID, created *time.Time, realSize uint64) {
-	v.Owner = owner
-	v.Created = created
-	v.Size = realSize
+	ID        uint64
+	ParenID   uint64
+	OID       oid.ID
+	Timestamp uint64
+	Size      uint64
+	ETag      string
+	MD5       string
+	FilePath  string
 }
 
 type ObjectTaggingInfo struct {
@@ -109,7 +77,6 @@ type MultipartInfo struct {
 	Created       time.Time
 	Meta          map[string]string
 	CopiesNumbers []uint32
-	Finished      bool
 }
 
 // PartInfo is upload information about part.
@@ -126,17 +93,9 @@ type PartInfo struct {
 
 // ToHeaderString form short part representation to use in S3-Completed-Parts header.
 func (p *PartInfo) ToHeaderString() string {
-	// ETag value contains SHA256 checksum which is used while getting object parts attributes.
 	return strconv.Itoa(p.Number) + "-" + strconv.FormatUint(p.Size, 10) + "-" + p.ETag
 }
 
-func (p *PartInfo) GetETag(md5Enabled bool) string {
-	if md5Enabled && len(p.MD5) > 0 {
-		return p.MD5
-	}
-	return p.ETag
-}
-
 // LockInfo is lock information to create appropriate tree node.
 type LockInfo struct {
 	id uint64

api/handler/acl.go

@@ -8,7 +8,6 @@ import (
 	"encoding/json"
 	stderrors "errors"
 	"fmt"
-	"io"
 	"net/http"
 	"sort"
 	"strconv"
@@ -25,9 +24,6 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/session"
-	engineiam "git.frostfs.info/TrueCloudLab/policy-engine/iam"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"go.uber.org/zap"
 )
@@ -469,7 +465,7 @@ func (h *handler) PutObjectACLHandler(w http.ResponseWriter, r *http.Request) {
 	if updated {
 		s := &SendNotificationParams{
 			Event:            EventObjectACLPut,
-			NotificationInfo: data.NotificationInfoFromObject(objInfo, h.cfg.MD5Enabled()),
+			NotificationInfo: data.NotificationInfoFromObject(objInfo),
 			BktInfo:          bktInfo,
 			ReqInfo:          reqInfo,
 		}
@@ -489,45 +485,19 @@ func (h *handler) GetBucketPolicyHandler(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	resolvedNamespace := h.cfg.ResolveNamespaceAlias(reqInfo.Namespace)
-	jsonPolicy, err := h.ape.GetPolicy(resolvedNamespace, bktInfo.CID)
+	bucketACL, err := h.obj.GetBucketACL(r.Context(), bktInfo)
 	if err != nil {
-		if strings.Contains(err.Error(), "not found") {
-			err = fmt.Errorf("%w: %s", errors.GetAPIError(errors.ErrNoSuchBucketPolicy), err.Error())
-		}
-		h.logAndSendError(w, "failed to get policy from storage", reqInfo, err)
+		h.logAndSendError(w, "could not fetch bucket acl", reqInfo, err)
 		return
 	}
 
-	w.Header().Set(api.ContentType, "application/json")
+	ast := tableToAst(bucketACL.EACL, reqInfo.BucketName)
+	bktPolicy := astToPolicy(ast)
+
 	w.WriteHeader(http.StatusOK)
 
-	if _, err = w.Write(jsonPolicy); err != nil {
-		h.logAndSendError(w, "write json policy to client", reqInfo, err)
-	}
-}
-
-func (h *handler) DeleteBucketPolicyHandler(w http.ResponseWriter, r *http.Request) {
-	reqInfo := middleware.GetReqInfo(r.Context())
-
-	bktInfo, err := h.getBucketAndCheckOwner(r, reqInfo.BucketName)
-	if err != nil {
-		h.logAndSendError(w, "could not get bucket info", reqInfo, err)
-		return
-	}
-
-	resolvedNamespace := h.cfg.ResolveNamespaceAlias(reqInfo.Namespace)
-
-	target := engine.NamespaceTarget(resolvedNamespace)
-	chainID := getBucketChainID(bktInfo)
-	if err = h.ape.RemoveChain(target, chainID); err != nil {
-		h.logAndSendError(w, "failed to remove morph rule chain", reqInfo, err)
-		return
-	}
-
-	if err = h.ape.DeletePolicy(resolvedNamespace, bktInfo.CID); err != nil {
-		h.logAndSendError(w, "failed to delete policy from storage", reqInfo, err)
-		return
+	if err = json.NewEncoder(w).Encode(bktPolicy); err != nil {
+		h.logAndSendError(w, "something went wrong", reqInfo, err)
 	}
 }
 
@@ -553,52 +523,30 @@ func (h *handler) PutBucketPolicyHandler(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	jsonPolicy, err := io.ReadAll(r.Body)
+	token, err := getSessionTokenSetEACL(r.Context())
 	if err != nil {
-		h.logAndSendError(w, "read body", reqInfo, err)
+		h.logAndSendError(w, "couldn't get eacl token", reqInfo, err)
 		return
 	}
 
-	var bktPolicy engineiam.Policy
-	if err = json.Unmarshal(jsonPolicy, &bktPolicy); err != nil {
+	bktPolicy := &bucketPolicy{Bucket: reqInfo.BucketName}
+	if err = json.NewDecoder(r.Body).Decode(bktPolicy); err != nil {
 		h.logAndSendError(w, "could not parse bucket policy", reqInfo, err)
 		return
 	}
 
-	s3Chain, err := engineiam.ConvertToS3Chain(bktPolicy, h.frostfsid)
+	astPolicy, err := policyToAst(bktPolicy)
 	if err != nil {
-		h.logAndSendError(w, "could not convert s3 policy to chain policy", reqInfo, err)
-		return
-	}
-	s3Chain.ID = getBucketChainID(bktInfo)
-
-	for _, rule := range s3Chain.Rules {
-		for _, resource := range rule.Resources.Names {
-			if reqInfo.BucketName != strings.Split(strings.TrimPrefix(resource, arnAwsPrefix), "/")[0] {
-				h.logAndSendError(w, "policy resource mismatched bucket", reqInfo, errors.GetAPIError(errors.ErrMalformedPolicy))
-				return
-			}
-		}
-	}
-
-	resolvedNamespace := h.cfg.ResolveNamespaceAlias(reqInfo.Namespace)
-
-	target := engine.NamespaceTarget(resolvedNamespace)
-	if err = h.ape.AddChain(target, s3Chain); err != nil {
-		h.logAndSendError(w, "failed to add morph rule chain", reqInfo, err)
+		h.logAndSendError(w, "could not translate policy to ast", reqInfo, err)
 		return
 	}
 
-	if err = h.ape.PutPolicy(resolvedNamespace, bktInfo.CID, jsonPolicy); err != nil {
-		h.logAndSendError(w, "failed to save policy to storage", reqInfo, err)
+	if _, err = h.updateBucketACL(r, astPolicy, bktInfo, token); err != nil {
+		h.logAndSendError(w, "could not update bucket acl", reqInfo, err)
 		return
 	}
 }
 
-func getBucketChainID(bktInfo *data.BucketInfo) chain.ID {
-	return chain.ID("bkt" + string(bktInfo.CID[:]))
-}
-
 func parseACLHeaders(header http.Header, key *keys.PublicKey) (*AccessControlPolicy, error) {
 	var err error
 	acp := &AccessControlPolicy{Owner: Owner{
@@ -694,7 +642,7 @@ func parseGrantee(grantees string) ([]*Grantee, error) {
 }
 
 func formGrantee(granteeType, value string) (*Grantee, error) {
-	value = data.UnQuote(value)
+	value = strings.Trim(value, "\"")
 	switch granteeType {
 	case "id":
 		return &Grantee{
@@ -1186,6 +1134,73 @@ func resourceInfoFromName(name, bucketName string) resourceInfo {
 	return resInfo
 }
 
+func astToPolicy(ast *ast) *bucketPolicy {
+	bktPolicy := &bucketPolicy{}
+
+	for _, resource := range ast.Resources {
+		allowed, denied := triageOperations(resource.Operations)
+		handleResourceOperations(bktPolicy, allowed, eacl.ActionAllow, resource.Name())
+		handleResourceOperations(bktPolicy, denied, eacl.ActionDeny, resource.Name())
+	}
+
+	return bktPolicy
+}
+
+func handleResourceOperations(bktPolicy *bucketPolicy, list []*astOperation, eaclAction eacl.Action, resourceName string) {
+	userOpsMap := make(map[string][]eacl.Operation)
+
+	for _, op := range list {
+		if !op.IsGroupGrantee() {
+			for _, user := range op.Users {
+				userOps := userOpsMap[user]
+				userOps = append(userOps, op.Op)
+				userOpsMap[user] = userOps
+			}
+		} else {
+			userOps := userOpsMap[allUsersGroup]
+			userOps = append(userOps, op.Op)
+			userOpsMap[allUsersGroup] = userOps
+		}
+	}
+
+	for user, userOps := range userOpsMap {
+		var actions []string
+	LOOP:
+		for action, ops := range actionToOpMap {
+			for _, op := range ops {
+				if !contains(userOps, op) {
+					continue LOOP
+				}
+			}
+			actions = append(actions, action)
+		}
+		if len(actions) != 0 {
+			state := statement{
+				Effect:    actionToEffect(eaclAction),
+				Principal: principal{CanonicalUser: user},
+				Action:    actions,
+				Resource:  []string{arnAwsPrefix + resourceName},
+			}
+			if user == allUsersGroup {
+				state.Principal = principal{AWS: allUsersWildcard}
+			}
+			bktPolicy.Statement = append(bktPolicy.Statement, state)
+		}
+	}
+}
+
+func triageOperations(operations []*astOperation) ([]*astOperation, []*astOperation) {
+	var allowed, denied []*astOperation
+	for _, op := range operations {
+		if op.Action == eacl.ActionAllow {
+			allowed = append(allowed, op)
+		} else {
+			denied = append(denied, op)
+		}
+	}
+	return allowed, denied
+}
+
 func addTo(list []*astOperation, userID string, op eacl.Operation, groupGrantee bool, action eacl.Action) []*astOperation {
 	var found *astOperation
 	for _, astop := range list {
@@ -1372,6 +1387,17 @@ func effectToAction(effect string) eacl.Action {
 	return eacl.ActionUnknown
 }
 
+func actionToEffect(action eacl.Action) string {
+	switch action {
+	case eacl.ActionAllow:
+		return "Allow"
+	case eacl.ActionDeny:
+		return "Deny"
+	default:
+		return ""
+	}
+}
+
 func permissionToOperations(permission AWSACL) []eacl.Operation {
 	switch permission {
 	case aclFullControl:

api/handler/acl_test.go

@@ -23,7 +23,6 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/session"
-	engineiam "git.frostfs.info/TrueCloudLab/policy-engine/iam"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"github.com/stretchr/testify/require"
 )
@@ -1317,26 +1316,42 @@ func TestBucketPolicy(t *testing.T) {
 	hc := prepareHandlerContext(t)
 	bktName := "bucket-for-policy"
 
-	createTestBucket(hc, bktName)
+	box, key := createAccessBox(t)
+	createBucket(t, hc, bktName, box)
 
-	getBucketPolicy(hc, bktName, s3errors.ErrNoSuchBucketPolicy)
+	bktPolicy := getBucketPolicy(hc, bktName)
+	for _, st := range bktPolicy.Statement {
+		if st.Effect == "Allow" {
+			require.Equal(t, hex.EncodeToString(key.PublicKey().Bytes()), st.Principal.CanonicalUser)
+			require.Equal(t, []string{arnAwsPrefix + bktName}, st.Resource)
+		} else {
+			require.Equal(t, allUsersWildcard, st.Principal.AWS)
+			require.Equal(t, "Deny", st.Effect)
+			require.Equal(t, []string{arnAwsPrefix + bktName}, st.Resource)
+		}
+	}
 
-	newPolicy := engineiam.Policy{
-		Statement: []engineiam.Statement{{
-			Principal: map[engineiam.PrincipalType][]string{engineiam.Wildcard: {}},
-			Effect:    engineiam.DenyEffect,
-			Action:    engineiam.Action{"s3:PutObject"},
-			Resource:  engineiam.Resource{"arn:aws:s3:::test/*"},
+	newPolicy := &bucketPolicy{
+		Statement: []statement{{
+			Effect:    "Allow",
+			Principal: principal{AWS: allUsersWildcard},
+			Action:    []string{s3GetObject},
+			Resource:  []string{arnAwsPrefix + "dummy"},
 		}},
 	}
 
-	putBucketPolicy(hc, bktName, newPolicy, s3errors.ErrMalformedPolicy)
+	putBucketPolicy(hc, bktName, newPolicy, box, http.StatusInternalServerError)
 
-	newPolicy.Statement[0].Resource[0] = arnAwsPrefix + bktName + "/*"
-	putBucketPolicy(hc, bktName, newPolicy)
+	newPolicy.Statement[0].Resource[0] = arnAwsPrefix + bktName
+	putBucketPolicy(hc, bktName, newPolicy, box, http.StatusOK)
 
-	bktPolicy := getBucketPolicy(hc, bktName)
-	require.Equal(t, newPolicy, bktPolicy)
+	bktPolicy = getBucketPolicy(hc, bktName)
+	for _, st := range bktPolicy.Statement {
+		if st.Effect == "Allow" && st.Principal.AWS == allUsersWildcard {
+			require.Equal(t, []string{arnAwsPrefix + bktName}, st.Resource)
+			require.ElementsMatch(t, []string{s3GetObject, s3ListBucket}, st.Action)
+		}
+	}
 }
 
 func TestBucketPolicyUnmarshal(t *testing.T) {
@@ -1396,7 +1411,9 @@ func TestPutBucketPolicy(t *testing.T) {
 {
 	"Version": "2012-10-17",
 	"Statement": [{
-		"Principal": "*",
+		"Principal": {
+			"AWS": "*"
+		},
 		"Effect": "Deny",
 		"Action": "s3:GetObject",
 		"Resource": "arn:aws:s3:::bucket-for-policy/*"
@@ -1406,41 +1423,36 @@ func TestPutBucketPolicy(t *testing.T) {
 	hc := prepareHandlerContext(t)
 	bktName := "bucket-for-policy"
 
-	createTestBucket(hc, bktName)
+	box, _ := createAccessBox(t)
+	createBucket(t, hc, bktName, box)
 
 	w, r := prepareTestPayloadRequest(hc, bktName, "", bytes.NewReader([]byte(bktPolicy)))
+	ctx := middleware.SetBoxData(r.Context(), box)
+	r = r.WithContext(ctx)
 	hc.Handler().PutBucketPolicyHandler(w, r)
 	assertStatus(hc.t, w, http.StatusOK)
 }
 
-func getBucketPolicy(hc *handlerContext, bktName string, errCode ...s3errors.ErrorCode) engineiam.Policy {
+func getBucketPolicy(hc *handlerContext, bktName string) *bucketPolicy {
 	w, r := prepareTestRequest(hc, bktName, "", nil)
 	hc.Handler().GetBucketPolicyHandler(w, r)
 
-	var policy engineiam.Policy
-	if len(errCode) == 0 {
-		assertStatus(hc.t, w, http.StatusOK)
-		err := json.NewDecoder(w.Result().Body).Decode(&policy)
-		require.NoError(hc.t, err)
-	} else {
-		assertS3Error(hc.t, w, s3errors.GetAPIError(errCode[0]))
-	}
-
+	assertStatus(hc.t, w, http.StatusOK)
+	policy := &bucketPolicy{}
+	err := json.NewDecoder(w.Result().Body).Decode(policy)
+	require.NoError(hc.t, err)
 	return policy
 }
 
-func putBucketPolicy(hc *handlerContext, bktName string, bktPolicy engineiam.Policy, errCode ...s3errors.ErrorCode) {
+func putBucketPolicy(hc *handlerContext, bktName string, bktPolicy *bucketPolicy, box *accessbox.Box, status int) {
 	body, err := json.Marshal(bktPolicy)
 	require.NoError(hc.t, err)
 
 	w, r := prepareTestPayloadRequest(hc, bktName, "", bytes.NewReader(body))
+	ctx := middleware.SetBoxData(r.Context(), box)
+	r = r.WithContext(ctx)
 	hc.Handler().PutBucketPolicyHandler(w, r)
-
-	if len(errCode) == 0 {
-		assertStatus(hc.t, w, http.StatusOK)
-	} else {
-		assertS3Error(hc.t, w, s3errors.GetAPIError(errCode[0]))
-	}
+	assertStatus(hc.t, w, status)
 }
 
 func checkLastRecords(t *testing.T, tc *handlerContext, bktInfo *data.BucketInfo, action eacl.Action) {

api/handler/api.go

@@ -12,10 +12,7 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/layer"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
-	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/netmap"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
 	"go.uber.org/zap"
 )
 
@@ -25,8 +22,6 @@ type (
 		obj         layer.Client
 		notificator Notificator
 		cfg         Config
-		ape         APE
-		frostfsid   FrostFSID
 	}
 
 	Notificator interface {
@@ -36,10 +31,10 @@ type (
 
 	// Config contains data which handler needs to keep.
 	Config interface {
-		DefaultPlacementPolicy(namespace string) netmap.PlacementPolicy
-		PlacementPolicy(namespace, constraint string) (netmap.PlacementPolicy, bool)
-		CopiesNumbers(namespace, constraint string) ([]uint32, bool)
-		DefaultCopiesNumbers(namespace string) []uint32
+		DefaultPlacementPolicy() netmap.PlacementPolicy
+		PlacementPolicy(string) (netmap.PlacementPolicy, bool)
+		CopiesNumbers(string) ([]uint32, bool)
+		DefaultCopiesNumbers() []uint32
 		NewXMLDecoder(io.Reader) *xml.Decoder
 		DefaultMaxAge() int
 		NotificatorEnabled() bool
@@ -47,52 +42,18 @@ type (
 		IsResolveListAllow() bool
 		BypassContentEncodingInChunks() bool
 		MD5Enabled() bool
-		ResolveNamespaceAlias(namespace string) string
 	}
-
-	FrostFSID interface {
-		GetUserAddress(account, user string) (string, error)
-	}
-
-	// APE is Access Policy Engine that needs to save policy and acl info to different places.
-	APE interface {
-		MorphRuleChainStorage
-		PolicyStorage
-	}
-
-	// MorphRuleChainStorage is a similar to engine.MorphRuleChainStorage
-	// but doesn't know anything about tx.
-	MorphRuleChainStorage interface {
-		AddChain(target engine.Target, c *chain.Chain) error
-		RemoveChain(target engine.Target, chainID chain.ID) error
-		ListChains(target engine.Target) ([]*chain.Chain, error)
-	}
-
-	// PolicyStorage is interface to save intact initial user provided policy.
-	PolicyStorage interface {
-		PutPolicy(namespace string, cnrID cid.ID, policy []byte) error
-		GetPolicy(namespace string, cnrID cid.ID) ([]byte, error)
-		DeletePolicy(namespace string, cnrID cid.ID) error
-	}
-
-	frostfsIDDisabled struct{}
 )
 
 var _ api.Handler = (*handler)(nil)
 
 // New creates new api.Handler using given logger and client.
-func New(log *zap.Logger, obj layer.Client, notificator Notificator, cfg Config, storage APE, ffsid FrostFSID) (api.Handler, error) {
+func New(log *zap.Logger, obj layer.Client, notificator Notificator, cfg Config) (api.Handler, error) {
 	switch {
 	case obj == nil:
 		return nil, errors.New("empty FrostFS Object Layer")
 	case log == nil:
 		return nil, errors.New("empty logger")
-	case storage == nil:
-		return nil, errors.New("empty policy storage")
-	}
-
-	if ffsid == nil {
-		ffsid = frostfsIDDisabled{}
 	}
 
 	if !cfg.NotificatorEnabled() {
@@ -105,21 +66,15 @@ func New(log *zap.Logger, obj layer.Client, notificator Notificator, cfg Config,
 		log:         log,
 		obj:         obj,
 		cfg:         cfg,
-		ape:         storage,
 		notificator: notificator,
-		frostfsid:   ffsid,
 	}, nil
 }
 
-func (f frostfsIDDisabled) GetUserAddress(_, _ string) (string, error) {
-	return "", errors.New("frostfsid disabled")
-}
-
 // pickCopiesNumbers chooses the return values following this logic:
 // 1) array of copies numbers sent in request's header has the highest priority.
 // 2) array of copies numbers with corresponding location constraint provided in the config file.
 // 3) default copies number from the config file wrapped into array.
-func (h *handler) pickCopiesNumbers(metadata map[string]string, namespace, locationConstraint string) ([]uint32, error) {
+func (h *handler) pickCopiesNumbers(metadata map[string]string, locationConstraint string) ([]uint32, error) {
 	copiesNumbersStr, ok := metadata[layer.AttributeFrostfsCopiesNumber]
 	if ok {
 		result, err := parseCopiesNumbers(copiesNumbersStr)
@@ -129,12 +84,12 @@ func (h *handler) pickCopiesNumbers(metadata map[string]string, namespace, locat
 		return result, nil
 	}
 
-	copiesNumbers, ok := h.cfg.CopiesNumbers(namespace, locationConstraint)
+	copiesNumbers, ok := h.cfg.CopiesNumbers(locationConstraint)
 	if ok {
 		return copiesNumbers, nil
 	}
 
-	return h.cfg.DefaultCopiesNumbers(namespace), nil
+	return h.cfg.DefaultCopiesNumbers(), nil
 }
 
 func parseCopiesNumbers(copiesNumbersStr string) ([]uint32, error) {

api/handler/api_test.go

@@ -26,7 +26,7 @@ func TestCopiesNumberPicker(t *testing.T) {
 		metadata["somekey1"] = "5, 6, 7"
 		expectedCopiesNumbers := []uint32{1}
 
-		actualCopiesNumbers, err := h.pickCopiesNumbers(metadata, "", locationConstraint2)
+		actualCopiesNumbers, err := h.pickCopiesNumbers(metadata, locationConstraint2)
 		require.NoError(t, err)
 		require.Equal(t, expectedCopiesNumbers, actualCopiesNumbers)
 	})
@@ -35,7 +35,7 @@ func TestCopiesNumberPicker(t *testing.T) {
 		metadata["somekey2"] = "6, 7, 8"
 		expectedCopiesNumbers := []uint32{2, 3, 4}
 
-		actualCopiesNumbers, err := h.pickCopiesNumbers(metadata, "", locationConstraint1)
+		actualCopiesNumbers, err := h.pickCopiesNumbers(metadata, locationConstraint1)
 		require.NoError(t, err)
 		require.Equal(t, expectedCopiesNumbers, actualCopiesNumbers)
 	})
@@ -44,7 +44,7 @@ func TestCopiesNumberPicker(t *testing.T) {
 		metadata["frostfs-copies-number"] = "7, 8, 9"
 		expectedCopiesNumbers := []uint32{7, 8, 9}
 
-		actualCopiesNumbers, err := h.pickCopiesNumbers(metadata, "", locationConstraint2)
+		actualCopiesNumbers, err := h.pickCopiesNumbers(metadata, locationConstraint2)
 		require.NoError(t, err)
 		require.Equal(t, expectedCopiesNumbers, actualCopiesNumbers)
 	})
@@ -53,7 +53,7 @@ func TestCopiesNumberPicker(t *testing.T) {
 		metadata["frostfs-copies-number"] = "7,8,9"
 		expectedCopiesNumbers := []uint32{7, 8, 9}
 
-		actualCopiesNumbers, err := h.pickCopiesNumbers(metadata, "", locationConstraint2)
+		actualCopiesNumbers, err := h.pickCopiesNumbers(metadata, locationConstraint2)
 		require.NoError(t, err)
 		require.Equal(t, expectedCopiesNumbers, actualCopiesNumbers)
 	})
@@ -62,7 +62,7 @@ func TestCopiesNumberPicker(t *testing.T) {
 		metadata["frostfs-copies-number"] = "11, 12, 13, "
 		expectedCopiesNumbers := []uint32{11, 12, 13}
 
-		actualCopiesNumbers, err := h.pickCopiesNumbers(metadata, "", locationConstraint2)
+		actualCopiesNumbers, err := h.pickCopiesNumbers(metadata, locationConstraint2)
 		require.NoError(t, err)
 		require.Equal(t, expectedCopiesNumbers, actualCopiesNumbers)
 	})

api/handler/attributes.go

@@ -1,8 +1,6 @@
 package handler
 
 import (
-	"encoding/base64"
-	"encoding/hex"
 	"fmt"
 	"net/http"
 	"strconv"
@@ -108,7 +106,7 @@ func (h *handler) GetObjectAttributesHandler(w http.ResponseWriter, r *http.Requ
 		return
 	}
 
-	if err = checkPreconditions(info, params.Conditional, h.cfg.MD5Enabled()); err != nil {
+	if err = checkPreconditions(info, params.Conditional); err != nil {
 		h.logAndSendError(w, "precondition failed", reqInfo, err)
 		return
 	}
@@ -119,7 +117,7 @@ func (h *handler) GetObjectAttributesHandler(w http.ResponseWriter, r *http.Requ
 		return
 	}
 
-	response, err := encodeToObjectAttributesResponse(info, params, h.cfg.MD5Enabled())
+	response, err := encodeToObjectAttributesResponse(info, params)
 	if err != nil {
 		h.logAndSendError(w, "couldn't encode object info to response", reqInfo, err)
 		return
@@ -137,7 +135,7 @@ func writeAttributesHeaders(h http.Header, info *data.ExtendedObjectInfo, isBuck
 		h.Set(api.AmzVersionID, info.Version())
 	}
 
-	if info.NodeVersion.IsDeleteMarker {
+	if info.NodeVersion.IsDeleteMarker() {
 		h.Set(api.AmzDeleteMarker, strconv.FormatBool(true))
 	}
 
@@ -181,23 +179,19 @@ func parseGetObjectAttributeArgs(r *http.Request) (*GetObjectAttributesArgs, err
 	return res, err
 }
 
-func encodeToObjectAttributesResponse(info *data.ObjectInfo, p *GetObjectAttributesArgs, md5Enabled bool) (*GetObjectAttributesResponse, error) {
+func encodeToObjectAttributesResponse(info *data.ObjectInfo, p *GetObjectAttributesArgs) (*GetObjectAttributesResponse, error) {
 	resp := &GetObjectAttributesResponse{}
 
 	for _, attr := range p.Attributes {
 		switch attr {
 		case eTag:
-			resp.ETag = data.Quote(info.ETag(md5Enabled))
+			resp.ETag = info.HashSum
 		case storageClass:
 			resp.StorageClass = api.DefaultStorageClass
 		case objectSize:
 			resp.ObjectSize = info.Size
 		case checksum:
-			checksumBytes, err := hex.DecodeString(info.HashSum)
-			if err != nil {
-				return nil, fmt.Errorf("form upload attributes: %w", err)
-			}
-			resp.Checksum = &Checksum{ChecksumSHA256: base64.StdEncoding.EncodeToString(checksumBytes)}
+			resp.Checksum = &Checksum{ChecksumSHA256: info.HashSum}
 		case objectParts:
 			parts, err := formUploadAttributes(info, p.MaxParts, p.PartNumberMarker)
 			if err != nil {
@@ -225,15 +219,10 @@ func formUploadAttributes(info *data.ObjectInfo, maxParts, marker int) (*ObjectP
 		if err != nil {
 			return nil, fmt.Errorf("invalid completed part: %w", err)
 		}
-		// ETag value contains SHA256 checksum.
-		checksumBytes, err := hex.DecodeString(part.ETag)
-		if err != nil {
-			return nil, fmt.Errorf("invalid sha256 checksum in completed part: %w", err)
-		}
 		parts[i] = Part{
 			PartNumber:     part.PartNumber,
 			Size:           int(part.Size),
-			ChecksumSHA256: base64.StdEncoding.EncodeToString(checksumBytes),
+			ChecksumSHA256: part.ETag,
 		}
 	}
 

api/handler/attributes_test.go

@@ -1,8 +1,6 @@
 package handler
 
 import (
-	"encoding/base64"
-	"encoding/hex"
 	"strings"
 	"testing"
 
@@ -26,13 +24,11 @@ func TestGetObjectPartsAttributes(t *testing.T) {
 	multipartUpload := createMultipartUpload(hc, bktName, objMultipartName, map[string]string{})
 	etag, _ := uploadPart(hc, bktName, objMultipartName, multipartUpload.UploadID, 1, partSize)
 	completeMultipartUpload(hc, bktName, objMultipartName, multipartUpload.UploadID, []string{etag})
-	etagBytes, err := hex.DecodeString(etag[1 : len(etag)-1])
-	require.NoError(t, err)
 
 	result = getObjectAttributes(hc, bktName, objMultipartName, objectParts)
 	require.NotNil(t, result.ObjectParts)
 	require.Len(t, result.ObjectParts.Parts, 1)
-	require.Equal(t, base64.StdEncoding.EncodeToString(etagBytes), result.ObjectParts.Parts[0].ChecksumSHA256)
+	require.Equal(t, etag, result.ObjectParts.Parts[0].ChecksumSHA256)
 	require.Equal(t, partSize, result.ObjectParts.Parts[0].Size)
 	require.Equal(t, 1, result.ObjectParts.PartsCount)
 }

api/handler/copy.go

@@ -177,7 +177,7 @@ func (h *handler) CopyObjectHandler(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	if err = checkPreconditions(srcObjInfo, args.Conditional, h.cfg.MD5Enabled()); err != nil {
+	if err = checkPreconditions(srcObjInfo, args.Conditional); err != nil {
 		h.logAndSendError(w, "precondition failed", reqInfo, errors.GetAPIError(errors.ErrPreconditionFailed))
 		return
 	}
@@ -204,7 +204,7 @@ func (h *handler) CopyObjectHandler(w http.ResponseWriter, r *http.Request) {
 		DstEncryption: dstEncryptionParams,
 	}
 
-	params.CopiesNumbers, err = h.pickCopiesNumbers(metadata, reqInfo.Namespace, dstBktInfo.LocationConstraint)
+	params.CopiesNumbers, err = h.pickCopiesNumbers(metadata, dstBktInfo.LocationConstraint)
 	if err != nil {
 		h.logAndSendError(w, "invalid copies number", reqInfo, err)
 		return
@@ -224,10 +224,7 @@ func (h *handler) CopyObjectHandler(w http.ResponseWriter, r *http.Request) {
 	}
 	dstObjInfo := extendedDstObjInfo.ObjectInfo
 
-	if err = middleware.EncodeToResponse(w, &CopyObjectResponse{
-		LastModified: dstObjInfo.Created.UTC().Format(time.RFC3339),
-		ETag:         data.Quote(dstObjInfo.ETag(h.cfg.MD5Enabled())),
-	}); err != nil {
+	if err = middleware.EncodeToResponse(w, &CopyObjectResponse{LastModified: dstObjInfo.Created.UTC().Format(time.RFC3339), ETag: dstObjInfo.HashSum}); err != nil {
 		h.logAndSendError(w, "something went wrong", reqInfo, err, additional...)
 		return
 	}
@@ -271,7 +268,7 @@ func (h *handler) CopyObjectHandler(w http.ResponseWriter, r *http.Request) {
 
 	s := &SendNotificationParams{
 		Event:            EventObjectCreatedCopy,
-		NotificationInfo: data.NotificationInfoFromObject(dstObjInfo, h.cfg.MD5Enabled()),
+		NotificationInfo: data.NotificationInfoFromObject(dstObjInfo),
 		BktInfo:          dstBktInfo,
 		ReqInfo:          reqInfo,
 	}
@@ -314,8 +311,8 @@ func isCopyingToItselfForbidden(reqInfo *middleware.ReqInfo, srcBucket string, s
 func parseCopyObjectArgs(headers http.Header) (*copyObjectArgs, error) {
 	var err error
 	args := &conditionalArgs{
-		IfMatch:     data.UnQuote(headers.Get(api.AmzCopyIfMatch)),
-		IfNoneMatch: data.UnQuote(headers.Get(api.AmzCopyIfNoneMatch)),
+		IfMatch:     headers.Get(api.AmzCopyIfMatch),
+		IfNoneMatch: headers.Get(api.AmzCopyIfNoneMatch),
 	}
 
 	if args.IfModifiedSince, err = parseHTTPTime(headers.Get(api.AmzCopyIfModifiedSince)); err != nil {

api/handler/cors.go

@@ -55,7 +55,7 @@ func (h *handler) PutBucketCorsHandler(w http.ResponseWriter, r *http.Request) {
 		NewDecoder: h.cfg.NewXMLDecoder,
 	}
 
-	p.CopiesNumbers, err = h.pickCopiesNumbers(parseMetadata(r), reqInfo.Namespace, bktInfo.LocationConstraint)
+	p.CopiesNumbers, err = h.pickCopiesNumbers(parseMetadata(r), bktInfo.LocationConstraint)
 	if err != nil {
 		h.logAndSendError(w, "invalid copies number", reqInfo, err)
 		return

api/handler/delete_test.go

@@ -243,7 +243,6 @@ func TestDeleteMarkerVersioned(t *testing.T) {
 		deleteMarkerVersion, isDeleteMarker := deleteObject(t, tc, bktName, objName, emptyVersion)
 		require.True(t, isDeleteMarker)
 		versions := listVersions(t, tc, bktName)
-		require.Len(t, versions.DeleteMarker, 1)
 		require.Equal(t, deleteMarkerVersion, versions.DeleteMarker[0].VersionID)
 
 		_, isDeleteMarker = deleteObject(t, tc, bktName, objName, emptyVersion)
@@ -434,20 +433,17 @@ func createBucketAndObject(tc *handlerContext, bktName, objName string) (*data.B
 	return bktInfo, objInfo
 }
 
-func createVersionedBucketAndObject(_ *testing.T, tc *handlerContext, bktName, objName string) (*data.BucketInfo, *data.ObjectInfo) {
-	bktInfo := createVersionedBucket(tc, bktName)
+func createVersionedBucketAndObject(t *testing.T, tc *handlerContext, bktName, objName string) (*data.BucketInfo, *data.ObjectInfo) {
+	createTestBucket(tc, bktName)
+	bktInfo, err := tc.Layer().GetBucketInfo(tc.Context(), bktName)
+	require.NoError(t, err)
+	putBucketVersioning(t, tc, bktName, true)
+
 	objInfo := createTestObject(tc, bktInfo, objName, encryption.Params{})
 
 	return bktInfo, objInfo
 }
 
-func createVersionedBucket(hc *handlerContext, bktName string) *data.BucketInfo {
-	bktInfo := createTestBucket(hc, bktName)
-	putBucketVersioning(hc.t, hc, bktName, true)
-
-	return bktInfo
-}
-
 func putBucketVersioning(t *testing.T, tc *handlerContext, bktName string, enabled bool) {
 	cfg := &VersioningConfiguration{Status: "Suspended"}
 	if enabled {

api/handler/get.go

@@ -95,7 +95,7 @@ func writeHeaders(h http.Header, requestHeader http.Header, extendedInfo *data.E
 		h.Set(api.ContentLength, strconv.FormatUint(info.Size, 10))
 	}
 
-	h.Set(api.ETag, data.Quote(info.ETag(md5Enabled)))
+	h.Set(api.ETag, info.ETag(md5Enabled))
 
 	h.Set(api.AmzTaggingCount, strconv.Itoa(tagSetLength))
 	h.Set(api.AmzStorageClass, api.DefaultStorageClass)
@@ -157,7 +157,7 @@ func (h *handler) GetObjectHandler(w http.ResponseWriter, r *http.Request) {
 	}
 	info := extendedInfo.ObjectInfo
 
-	if err = checkPreconditions(info, conditional, h.cfg.MD5Enabled()); err != nil {
+	if err = checkPreconditions(info, conditional); err != nil {
 		h.logAndSendError(w, "precondition failed", reqInfo, err)
 		return
 	}
@@ -238,13 +238,12 @@ func (h *handler) GetObjectHandler(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-func checkPreconditions(info *data.ObjectInfo, args *conditionalArgs, md5Enabled bool) error {
-	etag := info.ETag(md5Enabled)
-	if len(args.IfMatch) > 0 && args.IfMatch != etag {
-		return fmt.Errorf("%w: etag mismatched: '%s', '%s'", errors.GetAPIError(errors.ErrPreconditionFailed), args.IfMatch, etag)
+func checkPreconditions(info *data.ObjectInfo, args *conditionalArgs) error {
+	if len(args.IfMatch) > 0 && args.IfMatch != info.HashSum {
+		return fmt.Errorf("%w: etag mismatched: '%s', '%s'", errors.GetAPIError(errors.ErrPreconditionFailed), args.IfMatch, info.HashSum)
 	}
-	if len(args.IfNoneMatch) > 0 && args.IfNoneMatch == etag {
-		return fmt.Errorf("%w: etag matched: '%s', '%s'", errors.GetAPIError(errors.ErrNotModified), args.IfNoneMatch, etag)
+	if len(args.IfNoneMatch) > 0 && args.IfNoneMatch == info.HashSum {
+		return fmt.Errorf("%w: etag matched: '%s', '%s'", errors.GetAPIError(errors.ErrNotModified), args.IfNoneMatch, info.HashSum)
 	}
 	if args.IfModifiedSince != nil && info.Created.Before(*args.IfModifiedSince) {
 		return fmt.Errorf("%w: not modified since '%s', last modified '%s'", errors.GetAPIError(errors.ErrNotModified),
@@ -268,8 +267,8 @@ func checkPreconditions(info *data.ObjectInfo, args *conditionalArgs, md5Enabled
 func parseConditionalHeaders(headers http.Header) (*conditionalArgs, error) {
 	var err error
 	args := &conditionalArgs{
-		IfMatch:     data.UnQuote(headers.Get(api.IfMatch)),
-		IfNoneMatch: data.UnQuote(headers.Get(api.IfNoneMatch)),
+		IfMatch:     strings.Trim(headers.Get(api.IfMatch), "\""),
+		IfNoneMatch: strings.Trim(headers.Get(api.IfNoneMatch), "\""),
 	}
 
 	if args.IfModifiedSince, err = parseHTTPTime(headers.Get(api.IfModifiedSince)); err != nil {

api/handler/get_test.go

@@ -147,7 +147,7 @@ func TestPreconditions(t *testing.T) {
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			actual := checkPreconditions(tc.info, tc.args, false)
+			actual := checkPreconditions(tc.info, tc.args)
 			if tc.expected == nil {
 				require.NoError(t, actual)
 			} else {
@@ -203,19 +203,18 @@ func TestGetObjectEnabledMD5(t *testing.T) {
 	_, objInfo := createBucketAndObject(hc, bktName, objName)
 
 	_, headers := getObject(hc, bktName, objName)
-	require.Equal(t, data.Quote(objInfo.HashSum), headers.Get(api.ETag))
+	require.Equal(t, objInfo.HashSum, headers.Get(api.ETag))
 
 	hc.config.md5Enabled = true
 	_, headers = getObject(hc, bktName, objName)
-	require.Equal(t, data.Quote(objInfo.MD5Sum), headers.Get(api.ETag))
+	require.Equal(t, objInfo.MD5Sum, headers.Get(api.ETag))
 }
 
-func putObjectContent(hc *handlerContext, bktName, objName, content string) http.Header {
+func putObjectContent(hc *handlerContext, bktName, objName, content string) {
 	body := bytes.NewReader([]byte(content))
 	w, r := prepareTestPayloadRequest(hc, bktName, objName, body)
 	hc.Handler().PutObjectHandler(w, r)
 	assertStatus(hc.t, w, http.StatusOK)
-	return w.Result().Header
 }
 
 func getObjectRange(t *testing.T, tc *handlerContext, bktName, objName string, start, end int) []byte {

api/handler/handlers_test.go

@@ -5,7 +5,6 @@ import (
 	"context"
 	"crypto/rand"
 	"encoding/xml"
-	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -27,12 +26,9 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/zap"
-	"golang.org/x/exp/slices"
 )
 
 type handlerContext struct {
@@ -45,8 +41,6 @@ type handlerContext struct {
 	config  *configMock
 
 	layerFeatures *layer.FeatureSettingsMock
-	treeMock      *tree.ServiceClientMemory
-	cache         *layer.Cache
 }
 
 func (hc *handlerContext) Handler() *handler {
@@ -73,20 +67,20 @@ type configMock struct {
 	md5Enabled                    bool
 }
 
-func (c *configMock) DefaultPlacementPolicy(_ string) netmap.PlacementPolicy {
+func (c *configMock) DefaultPlacementPolicy() netmap.PlacementPolicy {
 	return c.defaultPolicy
 }
 
-func (c *configMock) PlacementPolicy(_, _ string) (netmap.PlacementPolicy, bool) {
+func (c *configMock) PlacementPolicy(string) (netmap.PlacementPolicy, bool) {
 	return netmap.PlacementPolicy{}, false
 }
 
-func (c *configMock) CopiesNumbers(_, locationConstraint string) ([]uint32, bool) {
+func (c *configMock) CopiesNumbers(locationConstraint string) ([]uint32, bool) {
 	result, ok := c.copiesNumbers[locationConstraint]
 	return result, ok
 }
 
-func (c *configMock) DefaultCopiesNumbers(_ string) []uint32 {
+func (c *configMock) DefaultCopiesNumbers() []uint32 {
 	return c.defaultCopiesNumbers
 }
 
@@ -122,19 +116,15 @@ func (c *configMock) MD5Enabled() bool {
 	return c.md5Enabled
 }
 
-func (c *configMock) ResolveNamespaceAlias(ns string) string {
-	return ns
-}
-
 func prepareHandlerContext(t *testing.T) *handlerContext {
-	return prepareHandlerContextBase(t, layer.DefaultCachesConfigs(zap.NewExample()))
+	return prepareHandlerContextBase(t, false)
 }
 
 func prepareHandlerContextWithMinCache(t *testing.T) *handlerContext {
-	return prepareHandlerContextBase(t, getMinCacheConfig(zap.NewExample()))
+	return prepareHandlerContextBase(t, true)
 }
 
-func prepareHandlerContextBase(t *testing.T, cacheCfg *layer.CachesConfig) *handlerContext {
+func prepareHandlerContextBase(t *testing.T, minCache bool) *handlerContext {
 	key, err := keys.NewPrivateKey()
 	require.NoError(t, err)
 
@@ -149,20 +139,21 @@ func prepareHandlerContextBase(t *testing.T, cacheCfg *layer.CachesConfig) *hand
 	var owner user.ID
 	user.IDFromKey(&owner, key.PrivateKey.PublicKey)
 
-	memCli, err := tree.NewTreeServiceClientMemory()
-	require.NoError(t, err)
+	treeMock := NewTreeServiceMock(t)
 
-	treeMock := tree.NewTree(memCli, zap.NewExample())
+	cacheCfg := layer.DefaultCachesConfigs(l)
+	if minCache {
+		cacheCfg = getMinCacheConfig(l)
+	}
 
 	features := &layer.FeatureSettingsMock{}
 
 	layerCfg := &layer.Config{
-		Cache:       layer.NewCache(cacheCfg),
+		Caches:      cacheCfg,
 		AnonKey:     layer.AnonymousKey{Key: key},
 		Resolver:    testResolver,
 		TreeService: treeMock,
 		Features:    features,
-		GateOwner:   owner,
 	}
 
 	var pp netmap.PlacementPolicy
@@ -176,7 +167,6 @@ func prepareHandlerContextBase(t *testing.T, cacheCfg *layer.CachesConfig) *hand
 		log: l,
 		obj: layer.NewLayer(l, tp, layerCfg),
 		cfg: cfg,
-		ape: newAPEMock(),
 	}
 
 	return &handlerContext{
@@ -189,8 +179,6 @@ func prepareHandlerContextBase(t *testing.T, cacheCfg *layer.CachesConfig) *hand
 		config:  cfg,
 
 		layerFeatures: features,
-		treeMock:      memCli,
-		cache:         layerCfg.Cache,
 	}
 }
 
@@ -204,7 +192,6 @@ func getMinCacheConfig(logger *zap.Logger) *layer.CachesConfig {
 		Logger:        logger,
 		Objects:       minCacheCfg,
 		ObjectsList:   minCacheCfg,
-		SessionList:   minCacheCfg,
 		Names:         minCacheCfg,
 		Buckets:       minCacheCfg,
 		System:        minCacheCfg,
@@ -212,58 +199,10 @@ func getMinCacheConfig(logger *zap.Logger) *layer.CachesConfig {
 	}
 }
 
-type apeMock struct {
-	chainMap  map[engine.Target][]*chain.Chain
-	policyMap map[string][]byte
-}
-
-func newAPEMock() *apeMock {
-	return &apeMock{
-		chainMap:  map[engine.Target][]*chain.Chain{},
-		policyMap: map[string][]byte{},
-	}
-}
-
-func (a *apeMock) AddChain(target engine.Target, c *chain.Chain) error {
-	list := a.chainMap[target]
-
-	ind := slices.IndexFunc(list, func(item *chain.Chain) bool { return bytes.Equal(item.ID, c.ID) })
-	if ind != -1 {
-		list[ind] = c
-	} else {
-		list = append(list, c)
-	}
-
-	a.chainMap[target] = list
-	return nil
-}
-
-func (a *apeMock) RemoveChain(target engine.Target, chainID chain.ID) error {
-	a.chainMap[target] = slices.DeleteFunc(a.chainMap[target], func(item *chain.Chain) bool { return bytes.Equal(item.ID, chainID) })
-	return nil
-}
-
-func (a *apeMock) ListChains(target engine.Target) ([]*chain.Chain, error) {
-	return a.chainMap[target], nil
-}
-
-func (a *apeMock) PutPolicy(namespace string, cnrID cid.ID, policy []byte) error {
-	a.policyMap[namespace+cnrID.EncodeToString()] = policy
-	return nil
-}
-
-func (a *apeMock) GetPolicy(namespace string, cnrID cid.ID) ([]byte, error) {
-	policy, ok := a.policyMap[namespace+cnrID.EncodeToString()]
-	if !ok {
-		return nil, errors.New("not found")
-	}
-
-	return policy, nil
-}
-
-func (a *apeMock) DeletePolicy(namespace string, cnrID cid.ID) error {
-	delete(a.policyMap, namespace+cnrID.EncodeToString())
-	return nil
+func NewTreeServiceMock(t *testing.T) *tree.Tree {
+	memCli, err := tree.NewTreeServiceClientMemory()
+	require.NoError(t, err)
+	return tree.NewTree(memCli, zap.NewExample())
 }
 
 func createTestBucket(hc *handlerContext, bktName string) *data.BucketInfo {

api/handler/head.go

@@ -65,7 +65,7 @@ func (h *handler) HeadObjectHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err = checkPreconditions(info, conditional, h.cfg.MD5Enabled()); err != nil {
+	if err = checkPreconditions(info, conditional); err != nil {
 		h.logAndSendError(w, "precondition failed", reqInfo, err)
 		return
 	}

api/handler/locking.go

@@ -145,7 +145,7 @@ func (h *handler) PutObjectLegalHoldHandler(w http.ResponseWriter, r *http.Reque
 		},
 	}
 
-	p.CopiesNumbers, err = h.pickCopiesNumbers(parseMetadata(r), reqInfo.Namespace, bktInfo.LocationConstraint)
+	p.CopiesNumbers, err = h.pickCopiesNumbers(parseMetadata(r), bktInfo.LocationConstraint)
 	if err != nil {
 		h.logAndSendError(w, "invalid copies number", reqInfo, err)
 		return
@@ -229,7 +229,7 @@ func (h *handler) PutObjectRetentionHandler(w http.ResponseWriter, r *http.Reque
 		NewLock: lock,
 	}
 
-	p.CopiesNumbers, err = h.pickCopiesNumbers(parseMetadata(r), reqInfo.Namespace, bktInfo.LocationConstraint)
+	p.CopiesNumbers, err = h.pickCopiesNumbers(parseMetadata(r), bktInfo.LocationConstraint)
 	if err != nil {
 		h.logAndSendError(w, "invalid copies number", reqInfo, err)
 		return

api/handler/multipart_upload.go

@@ -157,7 +157,7 @@ func (h *handler) CreateMultipartUploadHandler(w http.ResponseWriter, r *http.Re
 		p.Header[api.ContentLanguage] = contentLanguage
 	}
 
-	p.CopiesNumbers, err = h.pickCopiesNumbers(p.Header, reqInfo.Namespace, bktInfo.LocationConstraint)
+	p.CopiesNumbers, err = h.pickCopiesNumbers(p.Header, bktInfo.LocationConstraint)
 	if err != nil {
 		h.logAndSendError(w, "invalid copies number", reqInfo, err, additional...)
 		return
@@ -242,11 +242,10 @@ func (h *handler) UploadPartHandler(w http.ResponseWriter, r *http.Request) {
 			Bkt:      bktInfo,
 			Key:      reqInfo.ObjectName,
 		},
-		PartNumber:        partNumber,
-		Size:              size,
-		Reader:            body,
-		ContentMD5:        r.Header.Get(api.ContentMD5),
-		ContentSHA256Hash: r.Header.Get(api.AmzContentSha256),
+		PartNumber: partNumber,
+		Size:       size,
+		Reader:     body,
+		ContentMD5: r.Header.Get(api.ContentMD5),
 	}
 
 	p.Info.Encryption, err = formEncryptionParams(r)
@@ -265,7 +264,7 @@ func (h *handler) UploadPartHandler(w http.ResponseWriter, r *http.Request) {
 		addSSECHeaders(w.Header(), r.Header)
 	}
 
-	w.Header().Set(api.ETag, data.Quote(hash))
+	w.Header().Set(api.ETag, hash)
 	middleware.WriteSuccessResponseHeadersOnly(w)
 }
 
@@ -340,7 +339,7 @@ func (h *handler) UploadPartCopy(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err = checkPreconditions(srcInfo, args.Conditional, h.cfg.MD5Enabled()); err != nil {
+	if err = checkPreconditions(srcInfo, args.Conditional); err != nil {
 		h.logAndSendError(w, "precondition failed", reqInfo, errors.GetAPIError(errors.ErrPreconditionFailed),
 			additional...)
 		return
@@ -385,7 +384,7 @@ func (h *handler) UploadPartCopy(w http.ResponseWriter, r *http.Request) {
 
 	response := UploadPartCopyResponse{
 		LastModified: info.Created.UTC().Format(time.RFC3339),
-		ETag:         data.Quote(info.ETag(h.cfg.MD5Enabled())),
+		ETag:         info.ETag(h.cfg.MD5Enabled()),
 	}
 
 	if p.Info.Encryption.Enabled() {
@@ -450,7 +449,7 @@ func (h *handler) CompleteMultipartUploadHandler(w http.ResponseWriter, r *http.
 	response := CompleteMultipartUploadResponse{
 		Bucket: objInfo.Bucket,
 		Key:    objInfo.Name,
-		ETag:   data.Quote(objInfo.ETag(h.cfg.MD5Enabled())),
+		ETag:   objInfo.ETag(h.cfg.MD5Enabled()),
 	}
 
 	if settings.VersioningEnabled() {
@@ -514,7 +513,7 @@ func (h *handler) completeMultipartUpload(r *http.Request, c *layer.CompleteMult
 
 	s := &SendNotificationParams{
 		Event:            EventObjectCreatedCompleteMultipartUpload,
-		NotificationInfo: data.NotificationInfoFromObject(objInfo, h.cfg.MD5Enabled()),
+		NotificationInfo: data.NotificationInfoFromObject(objInfo),
 		BktInfo:          bktInfo,
 		ReqInfo:          reqInfo,
 	}

api/handler/multipart_upload_test.go

@@ -13,7 +13,6 @@ import (
 	"testing"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
 	s3Errors "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/layer"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/layer/encryption"
@@ -299,11 +298,11 @@ func TestMultipartUploadEnabledMD5(t *testing.T) {
 	multipartUpload := createMultipartUpload(hc, bktName, objName, map[string]string{})
 	etag1, partBody1 := uploadPart(hc, bktName, objName, multipartUpload.UploadID, 1, partSize)
 	md5Sum1 := md5.Sum(partBody1)
-	require.Equal(t, data.Quote(hex.EncodeToString(md5Sum1[:])), etag1)
+	require.Equal(t, hex.EncodeToString(md5Sum1[:]), etag1)
 
 	etag2, partBody2 := uploadPart(hc, bktName, objName, multipartUpload.UploadID, 2, partSize)
 	md5Sum2 := md5.Sum(partBody2)
-	require.Equal(t, data.Quote(hex.EncodeToString(md5Sum2[:])), etag2)
+	require.Equal(t, hex.EncodeToString(md5Sum2[:]), etag2)
 
 	w := completeMultipartUploadBase(hc, bktName, objName, multipartUpload.UploadID, []string{etag1, etag2})
 	assertStatus(t, w, http.StatusOK)
@@ -311,85 +310,7 @@ func TestMultipartUploadEnabledMD5(t *testing.T) {
 	err := xml.NewDecoder(w.Result().Body).Decode(resp)
 	require.NoError(t, err)
 	completeMD5Sum := md5.Sum(append(md5Sum1[:], md5Sum2[:]...))
-	require.Equal(t, data.Quote(hex.EncodeToString(completeMD5Sum[:])+"-2"), resp.ETag)
-}
-
-func TestUploadPartCheckContentSHA256(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName, objName := "bucket-1", "object-1"
-	createTestBucket(hc, bktName)
-	partSize := 5 * 1024 * 1024
-
-	for _, tc := range []struct {
-		name    string
-		hash    string
-		content []byte
-		error   bool
-	}{
-		{
-			name:    "invalid hash value",
-			hash:    "d1b2a59fbea7e20077af9f91b27e95e865061b270be03ff539ab3b73587882e8",
-			content: []byte("content"),
-			error:   true,
-		},
-		{
-			name:    "correct hash for empty payload",
-			hash:    "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-			content: []byte(""),
-			error:   false,
-		},
-		{
-			name:    "unsigned payload",
-			hash:    "UNSIGNED-PAYLOAD",
-			content: []byte("content"),
-			error:   false,
-		},
-		{
-			name:    "correct hash",
-			hash:    "ed7002b439e9ac845f22357d822bac1444730fbdb6016d3ec9432297b9ec9f73",
-			content: []byte("content"),
-			error:   false,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			multipartUpload := createMultipartUpload(hc, bktName, objName, map[string]string{})
-
-			etag1, data1 := uploadPart(hc, bktName, objName, multipartUpload.UploadID, 1, partSize)
-
-			query := make(url.Values)
-			query.Set(uploadIDQuery, multipartUpload.UploadID)
-			query.Set(partNumberQuery, strconv.Itoa(2))
-
-			w, r := prepareTestRequestWithQuery(hc, bktName, objName, query, tc.content)
-			r.Header.Set(api.AmzContentSha256, tc.hash)
-			hc.Handler().UploadPartHandler(w, r)
-			if tc.error {
-				assertS3Error(t, w, s3Errors.GetAPIError(s3Errors.ErrContentSHA256Mismatch))
-
-				list := listParts(hc, bktName, objName, multipartUpload.UploadID, "0", http.StatusOK)
-				require.Len(t, list.Parts, 1)
-
-				w := completeMultipartUploadBase(hc, bktName, objName, multipartUpload.UploadID, []string{etag1})
-				assertStatus(t, w, http.StatusOK)
-
-				data, _ := getObject(hc, bktName, objName)
-				equalDataSlices(t, data1, data)
-				return
-			}
-			assertStatus(t, w, http.StatusOK)
-
-			list := listParts(hc, bktName, objName, multipartUpload.UploadID, "0", http.StatusOK)
-			require.Len(t, list.Parts, 2)
-
-			etag2 := w.Header().Get(api.ETag)
-			w = completeMultipartUploadBase(hc, bktName, objName, multipartUpload.UploadID, []string{etag1, etag2})
-			assertStatus(t, w, http.StatusOK)
-
-			data, _ := getObject(hc, bktName, objName)
-			equalDataSlices(t, append(data1, tc.content...), data)
-		})
-	}
+	require.Equal(t, hex.EncodeToString(completeMD5Sum[:])+"-2", resp.ETag)
 }
 
 func uploadPartCopy(hc *handlerContext, bktName, objName, uploadID string, num int, srcObj string, start, end int) *UploadPartCopyResponse {

api/handler/not_support.go

@@ -7,6 +7,10 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/middleware"
 )
 
+func (h *handler) DeleteBucketPolicyHandler(w http.ResponseWriter, r *http.Request) {
+	h.logAndSendError(w, "not supported", middleware.GetReqInfo(r.Context()), errors.GetAPIError(errors.ErrNotSupported))
+}
+
 func (h *handler) DeleteBucketLifecycleHandler(w http.ResponseWriter, r *http.Request) {
 	h.logAndSendError(w, "not supported", middleware.GetReqInfo(r.Context()), errors.GetAPIError(errors.ErrNotSupported))
 }

api/handler/notifications.go

@@ -115,7 +115,7 @@ func (h *handler) PutBucketNotificationHandler(w http.ResponseWriter, r *http.Re
 		Configuration: conf,
 	}
 
-	p.CopiesNumbers, err = h.pickCopiesNumbers(parseMetadata(r), reqInfo.Namespace, bktInfo.LocationConstraint)
+	p.CopiesNumbers, err = h.pickCopiesNumbers(parseMetadata(r), bktInfo.LocationConstraint)
 	if err != nil {
 		h.logAndSendError(w, "invalid copies number", reqInfo, err)
 		return

api/handler/object_list.go

@@ -34,12 +34,12 @@ func (h *handler) ListObjectsV1Handler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err = middleware.EncodeToResponse(w, h.encodeV1(params, list)); err != nil {
+	if err = middleware.EncodeToResponse(w, encodeV1(params, list)); err != nil {
 		h.logAndSendError(w, "something went wrong", reqInfo, err)
 	}
 }
 
-func (h *handler) encodeV1(p *layer.ListObjectsParamsV1, list *layer.ListObjectsInfoV1) *ListObjectsV1Response {
+func encodeV1(p *layer.ListObjectsParamsV1, list *layer.ListObjectsInfoV1) *ListObjectsV1Response {
 	res := &ListObjectsV1Response{
 		Name:         p.BktInfo.Name,
 		EncodingType: p.Encode,
@@ -53,7 +53,7 @@ func (h *handler) encodeV1(p *layer.ListObjectsParamsV1, list *layer.ListObjects
 
 	res.CommonPrefixes = fillPrefixes(list.Prefixes, p.Encode)
 
-	res.Contents = fillContentsWithOwner(list.Objects, p.Encode, h.cfg.MD5Enabled())
+	res.Contents = fillContentsWithOwner(list.Objects, p.Encode)
 
 	return res
 }
@@ -78,12 +78,12 @@ func (h *handler) ListObjectsV2Handler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err = middleware.EncodeToResponse(w, h.encodeV2(params, list)); err != nil {
+	if err = middleware.EncodeToResponse(w, encodeV2(params, list)); err != nil {
 		h.logAndSendError(w, "something went wrong", reqInfo, err)
 	}
 }
 
-func (h *handler) encodeV2(p *layer.ListObjectsParamsV2, list *layer.ListObjectsInfoV2) *ListObjectsV2Response {
+func encodeV2(p *layer.ListObjectsParamsV2, list *layer.ListObjectsInfoV2) *ListObjectsV2Response {
 	res := &ListObjectsV2Response{
 		Name:                  p.BktInfo.Name,
 		EncodingType:          p.Encode,
@@ -99,7 +99,7 @@ func (h *handler) encodeV2(p *layer.ListObjectsParamsV2, list *layer.ListObjects
 
 	res.CommonPrefixes = fillPrefixes(list.Prefixes, p.Encode)
 
-	res.Contents = fillContents(list.Objects, p.Encode, p.FetchOwner, h.cfg.MD5Enabled())
+	res.Contents = fillContents(list.Objects, p.Encode, p.FetchOwner)
 
 	return res
 }
@@ -185,26 +185,29 @@ func fillPrefixes(src []string, encode string) []CommonPrefix {
 	return dst
 }
 
-func fillContentsWithOwner(src []*data.ExtendedNodeVersion, encode string, md5Enabled bool) []Object {
-	return fillContents(src, encode, true, md5Enabled)
+func fillContentsWithOwner(src []*data.ObjectInfo, encode string) []Object {
+	return fillContents(src, encode, true)
 }
 
-func fillContents(src []*data.ExtendedNodeVersion, encode string, fetchOwner, md5Enabled bool) []Object {
+func fillContents(src []*data.ObjectInfo, encode string, fetchOwner bool) []Object {
 	var dst []Object
 	for _, obj := range src {
 		res := Object{
-			Key:          s3PathEncode(obj.NodeVersion.FilePath, encode),
-			Size:         obj.NodeVersion.Size,
-			LastModified: obj.NodeVersion.Created.UTC().Format(time.RFC3339),
-			ETag:         data.Quote(obj.NodeVersion.GetETag(md5Enabled)),
+			Key:          s3PathEncode(obj.Name, encode),
+			Size:         obj.Size,
+			LastModified: obj.Created.UTC().Format(time.RFC3339),
+			ETag:         obj.HashSum,
 			StorageClass: api.DefaultStorageClass,
 		}
 
+		if size, err := layer.GetObjectSize(obj); err == nil {
+			res.Size = size
+		}
+
 		if fetchOwner {
-			owner := obj.NodeVersion.Owner.String()
 			res.Owner = &Owner{
-				ID:          owner,
-				DisplayName: owner,
+				ID:          obj.Owner.String(),
+				DisplayName: obj.Owner.String(),
 			}
 		}
 
@@ -281,15 +284,15 @@ func encodeListObjectVersionsToResponse(info *layer.ListObjectVersionsInfo, buck
 	for _, ver := range info.Version {
 		res.Version = append(res.Version, ObjectVersionResponse{
 			IsLatest:     ver.IsLatest,
-			Key:          ver.NodeVersion.FilePath,
-			LastModified: ver.NodeVersion.Created.UTC().Format(time.RFC3339),
+			Key:          ver.ObjectInfo.Name,
+			LastModified: ver.ObjectInfo.Created.UTC().Format(time.RFC3339),
 			Owner: Owner{
-				ID:          ver.NodeVersion.Owner.String(),
-				DisplayName: ver.NodeVersion.Owner.String(),
+				ID:          ver.ObjectInfo.Owner.String(),
+				DisplayName: ver.ObjectInfo.Owner.String(),
 			},
-			Size:         ver.NodeVersion.Size,
+			Size:         ver.ObjectInfo.Size,
 			VersionID:    ver.Version(),
-			ETag:         data.Quote(ver.NodeVersion.GetETag(md5Enabled)),
+			ETag:         ver.ObjectInfo.ETag(md5Enabled),
 			StorageClass: api.DefaultStorageClass,
 		})
 	}
@@ -297,11 +300,11 @@ func encodeListObjectVersionsToResponse(info *layer.ListObjectVersionsInfo, buck
 	for _, del := range info.DeleteMarker {
 		res.DeleteMarker = append(res.DeleteMarker, DeleteMarkerEntry{
 			IsLatest:     del.IsLatest,
-			Key:          del.NodeVersion.FilePath,
-			LastModified: del.NodeVersion.Created.UTC().Format(time.RFC3339),
+			Key:          del.ObjectInfo.Name,
+			LastModified: del.ObjectInfo.Created.UTC().Format(time.RFC3339),
 			Owner: Owner{
-				ID:          del.NodeVersion.Owner.String(),
-				DisplayName: del.NodeVersion.Owner.String(),
+				ID:          del.ObjectInfo.Owner.String(),
+				DisplayName: del.ObjectInfo.Owner.String(),
 			},
 			VersionID: del.Version(),
 		})

api/handler/object_list_test.go

@@ -1,22 +1,15 @@
 package handler
 
 import (
-	"context"
-	"fmt"
 	"net/http"
 	"net/url"
 	"sort"
 	"strconv"
 	"testing"
-	"time"
 
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/cache"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/layer"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/layer/encryption"
 	"github.com/stretchr/testify/require"
-	"go.uber.org/zap/zaptest"
 )
 
 func TestParseContinuationToken(t *testing.T) {
@@ -65,164 +58,13 @@ func TestListObjectNullVersions(t *testing.T) {
 	require.Equal(t, data.UnversionedObjectVersionID, result.Version[1].VersionID)
 }
 
-func TestListObjectsWithOldTreeNodes(t *testing.T) {
+func TestListObjectsPaging(t *testing.T) {
 	hc := prepareHandlerContext(t)
 
-	bktName, objName := "bucket-versioning-enabled", "object"
-	bktInfo := createTestBucket(hc, bktName)
-
-	srcEnc, err := encryption.NewParams([]byte("1234567890qwertyuiopasdfghjklzxc"))
-	require.NoError(t, err)
+	bktName := "bucket-versioning-enabled"
+	createTestBucket(hc, bktName)
 
 	n := 10
-	objInfos := make([]*data.ObjectInfo, n)
-	for i := 0; i < n; i++ {
-		objInfos[i] = createTestObject(hc, bktInfo, objName+strconv.Itoa(i), *srcEnc)
-	}
-	sort.Slice(objInfos, func(i, j int) bool { return objInfos[i].Name < objInfos[j].Name })
-
-	makeAllTreeObjectsOld(hc, bktInfo)
-
-	listV1 := listObjectsV1(hc, bktName, "", "", "", -1)
-	checkListOldNodes(hc, listV1.Contents, objInfos)
-
-	listV2 := listObjectsV2(hc, bktName, "", "", "", "", -1)
-	checkListOldNodes(hc, listV2.Contents, objInfos)
-
-	listVers := listObjectsVersions(hc, bktName, "", "", "", "", -1)
-	checkListVersionsOldNodes(hc, listVers.Version, objInfos)
-}
-
-func makeAllTreeObjectsOld(hc *handlerContext, bktInfo *data.BucketInfo) {
-	nodes, err := hc.treeMock.GetSubTree(hc.Context(), bktInfo, "version", 0, 0)
-	require.NoError(hc.t, err)
-
-	for _, node := range nodes {
-		if node.GetNodeID() == 0 {
-			continue
-		}
-		meta := make(map[string]string, len(node.GetMeta()))
-		for _, m := range node.GetMeta() {
-			if m.GetKey() != "Created" && m.GetKey() != "Owner" {
-				meta[m.GetKey()] = string(m.GetValue())
-			}
-		}
-
-		err = hc.treeMock.MoveNode(hc.Context(), bktInfo, "version", node.GetNodeID(), node.GetParentID(), meta)
-		require.NoError(hc.t, err)
-	}
-}
-
-func checkListOldNodes(hc *handlerContext, list []Object, objInfos []*data.ObjectInfo) {
-	require.Len(hc.t, list, len(objInfos))
-	for i := range list {
-		require.Equal(hc.t, objInfos[i].Name, list[i].Key)
-		realSize, err := layer.GetObjectSize(objInfos[i])
-		require.NoError(hc.t, err)
-		require.Equal(hc.t, objInfos[i].Owner.EncodeToString(), list[i].Owner.ID)
-		require.Equal(hc.t, objInfos[i].Created.UTC().Format(time.RFC3339), list[i].LastModified)
-		require.Equal(hc.t, realSize, list[i].Size)
-	}
-}
-
-func checkListVersionsOldNodes(hc *handlerContext, list []ObjectVersionResponse, objInfos []*data.ObjectInfo) {
-	require.Len(hc.t, list, len(objInfos))
-	for i := range list {
-		require.Equal(hc.t, objInfos[i].Name, list[i].Key)
-		realSize, err := layer.GetObjectSize(objInfos[i])
-		require.NoError(hc.t, err)
-		require.Equal(hc.t, objInfos[i].Owner.EncodeToString(), list[i].Owner.ID)
-		require.Equal(hc.t, objInfos[i].Created.UTC().Format(time.RFC3339), list[i].LastModified)
-		require.Equal(hc.t, realSize, list[i].Size)
-	}
-}
-
-func TestListObjectsContextCanceled(t *testing.T) {
-	layerCfg := layer.DefaultCachesConfigs(zaptest.NewLogger(t))
-	layerCfg.SessionList.Lifetime = time.Hour
-	layerCfg.SessionList.Size = 1
-
-	hc := prepareHandlerContextBase(t, layerCfg)
-
-	bktName := "bucket-versioning-enabled"
-	bktInfo := createTestBucket(hc, bktName)
-
-	for i := 0; i < 4; i++ {
-		putObject(hc, bktName, "object"+strconv.Itoa(i))
-	}
-
-	result := listObjectsV1(hc, bktName, "", "", "", 2)
-	session := hc.cache.GetListSession(hc.owner, cache.CreateListSessionCacheKey(bktInfo.CID, "", result.NextMarker))
-	// invoke list again to trigger cache eviction
-	// (use empty prefix to check that context canceled on replace)
-	listObjectsV1(hc, bktName, "", "", "", 2)
-	checkContextCanceled(session.Context, t)
-
-	result2 := listObjectsV2(hc, bktName, "", "", "", "", 2)
-	session2 := hc.cache.GetListSession(hc.owner, cache.CreateListSessionCacheKey(bktInfo.CID, "", result2.NextContinuationToken))
-	// invoke list again to trigger cache eviction
-	// (use non-empty prefix to check that context canceled on cache eviction)
-	listObjectsV2(hc, bktName, "o", "", "", "", 2)
-	checkContextCanceled(session2.Context, t)
-
-	result3 := listObjectsVersions(hc, bktName, "", "", "", "", 2)
-	session3 := hc.cache.GetListSession(hc.owner, cache.CreateListSessionCacheKey(bktInfo.CID, "", result3.NextVersionIDMarker))
-	// invoke list again to trigger cache eviction
-	listObjectsVersions(hc, bktName, "o", "", "", "", 2)
-	checkContextCanceled(session3.Context, t)
-}
-
-func checkContextCanceled(ctx context.Context, t *testing.T) {
-	select {
-	case <-ctx.Done():
-	case <-time.After(10 * time.Second):
-	}
-	require.ErrorIs(t, ctx.Err(), context.Canceled)
-}
-
-func TestListObjectsLatestVersions(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-versioning-enabled"
-	createTestBucket(hc, bktName)
-	putBucketVersioning(t, hc, bktName, true)
-
-	objName1, objName2 := "object1", "object2"
-	objContent1, objContent2 := "content1", "content2"
-
-	putObjectContent(hc, bktName, objName1, objContent1)
-	hdr1 := putObjectContent(hc, bktName, objName1, objContent2)
-	putObjectContent(hc, bktName, objName2, objContent1)
-	hdr2 := putObjectContent(hc, bktName, objName2, objContent2)
-
-	t.Run("listv1", func(t *testing.T) {
-		result := listObjectsV1(hc, bktName, "", "", "", -1)
-
-		require.Len(t, result.Contents, 2)
-		require.Equal(t, objName1, result.Contents[0].Key)
-		require.Equal(t, hdr1.Get(api.ETag), result.Contents[0].ETag)
-		require.Equal(t, objName2, result.Contents[1].Key)
-		require.Equal(t, hdr2.Get(api.ETag), result.Contents[1].ETag)
-	})
-
-	t.Run("listv2", func(t *testing.T) {
-		result := listObjectsV2(hc, bktName, "", "", "", "", -1)
-
-		require.Len(t, result.Contents, 2)
-		require.Equal(t, objName1, result.Contents[0].Key)
-		require.Equal(t, hdr1.Get(api.ETag), result.Contents[0].ETag)
-		require.Equal(t, objName2, result.Contents[1].Key)
-		require.Equal(t, hdr2.Get(api.ETag), result.Contents[1].ETag)
-	})
-}
-
-func TestListObjectsVersionsPaging(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-versioning-enabled"
-	createTestBucket(hc, bktName)
-
-	n := 12
 
 	var objects []string
 	for i := 0; i < n; i++ {
@@ -246,65 +88,6 @@ func TestListObjectsVersionsPaging(t *testing.T) {
 	require.Empty(t, objects)
 }
 
-func TestListObjectsVersionsCorrectIsLatestFlag(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-versioning-enabled"
-	createVersionedBucket(hc, bktName)
-
-	objName1, objName2 := "obj1", "obj2"
-
-	n := 9
-	listSize := 3
-	headers := make([]http.Header, n)
-	// objects uploaded: ["obj1"-v1, "obj1"-v2, "obj1"-v3, "obj2"-v1, "obj2"-v2, "obj2"-v3, "obj2"-v4, "obj2"-v5, "obj2"-v6]
-	for i := 0; i < n; i++ {
-		objName := objName1
-		if i >= listSize {
-			objName = objName2
-		}
-		headers[i] = putObjectContent(hc, bktName, objName, fmt.Sprintf("content/%d", i))
-	}
-
-	versions := listObjectsVersions(hc, bktName, "", "", "", "", listSize)
-	// expected objects: ["obj1"-v3, "obj1"-v2, "obj1"-v1]
-	checkListVersionsParts(t, versions, formReverseVersionResponse(objName1, headers[:listSize], true))
-
-	versions = listObjectsVersions(hc, bktName, "", "", versions.NextKeyMarker, versions.NextVersionIDMarker, listSize)
-	// expected objects: ["obj2"-v6, "obj2"-v5, "obj2"-v4]
-	checkListVersionsParts(t, versions, formReverseVersionResponse(objName2, headers[2*listSize:], true))
-
-	versions = listObjectsVersions(hc, bktName, "", "", versions.NextKeyMarker, versions.NextVersionIDMarker, listSize)
-	// expected objects: ["obj2"-v3, "obj2"-v2, "obj2"-v1]
-	checkListVersionsParts(t, versions, formReverseVersionResponse(objName2, headers[listSize:2*listSize], false))
-}
-
-func formReverseVersionResponse(objName string, headers []http.Header, isLatest bool) []ObjectVersionResponse {
-	res := make([]ObjectVersionResponse, len(headers))
-
-	for i, h := range headers {
-		ind := len(headers) - 1 - i
-		res[ind] = ObjectVersionResponse{
-			ETag:      h.Get(api.ETag),
-			IsLatest:  isLatest && ind == 0,
-			Key:       objName,
-			VersionID: h.Get(api.AmzVersionID),
-		}
-	}
-
-	return res
-}
-
-func checkListVersionsParts(t *testing.T, versions *ListObjectsVersionsResponse, expected []ObjectVersionResponse) {
-	require.Len(t, versions.Version, len(expected))
-	for i, res := range versions.Version {
-		require.Equal(t, expected[i].Key, res.Key)
-		require.Equal(t, expected[i].ETag, res.ETag)
-		require.Equal(t, expected[i].VersionID, res.VersionID)
-		require.Equal(t, expected[i].IsLatest, res.IsLatest)
-	}
-}
-
 func TestS3CompatibilityBucketListV2BothContinuationTokenStartAfter(t *testing.T) {
 	tc := prepareHandlerContext(t)
 
@@ -379,132 +162,6 @@ func TestS3BucketListDelimiterBasic(t *testing.T) {
 	require.Equal(t, "quux/", listV1Response.CommonPrefixes[1].Prefix)
 }
 
-func TestS3BucketListEmpty(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-for-listing"
-	createTestBucket(hc, bktName)
-
-	versions := listObjectsVersions(hc, bktName, "", "", "", "", -1)
-	require.Empty(t, versions.Version)
-	require.Empty(t, versions.DeleteMarker)
-	require.Empty(t, versions.CommonPrefixes)
-}
-
-func TestS3BucketListV2PrefixAlt(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-for-listing"
-	createTestBucket(hc, bktName)
-
-	objects := []string{"bar", "baz", "foo"}
-	for _, objName := range objects {
-		putObject(hc, bktName, objName)
-	}
-
-	response := listObjectsV2(hc, bktName, "ba", "", "", "", -1)
-
-	require.Equal(t, "ba", response.Prefix)
-	require.Len(t, response.Contents, 2)
-	require.Equal(t, "bar", response.Contents[0].Key)
-	require.Equal(t, "baz", response.Contents[1].Key)
-	require.Empty(t, response.CommonPrefixes)
-}
-
-func TestS3BucketListV2PrefixNotExist(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-for-listing"
-	createTestBucket(hc, bktName)
-
-	objects := []string{"foo/bar", "foo/baz", "quux"}
-	for _, objName := range objects {
-		putObject(hc, bktName, objName)
-	}
-
-	response := listObjectsV2(hc, bktName, "d", "", "", "", -1)
-
-	require.Equal(t, "d", response.Prefix)
-	require.Empty(t, response.Contents)
-	require.Empty(t, response.CommonPrefixes)
-}
-
-func TestS3BucketListV2PrefixUnreadable(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-for-listing"
-	createTestBucket(hc, bktName)
-
-	objects := []string{"foo/bar", "foo/baz", "quux"}
-	for _, objName := range objects {
-		putObject(hc, bktName, objName)
-	}
-
-	response := listObjectsV2(hc, bktName, "\x0a", "", "", "", -1)
-
-	require.Equal(t, "\x0a", response.Prefix)
-	require.Empty(t, response.Contents)
-	require.Empty(t, response.CommonPrefixes)
-}
-
-func TestS3BucketListV2PrefixDelimiterAlt(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-for-listing"
-	createTestBucket(hc, bktName)
-
-	objects := []string{"bar", "bazar", "cab", "foo"}
-	for _, objName := range objects {
-		putObject(hc, bktName, objName)
-	}
-
-	response := listObjectsV2(hc, bktName, "ba", "a", "", "", -1)
-
-	require.Equal(t, "ba", response.Prefix)
-	require.Equal(t, "a", response.Delimiter)
-	require.Len(t, response.Contents, 1)
-	require.Equal(t, "bar", response.Contents[0].Key)
-	require.Len(t, response.CommonPrefixes, 1)
-	require.Equal(t, "baza", response.CommonPrefixes[0].Prefix)
-}
-
-func TestS3BucketListV2PrefixDelimiterDelimiterNotExist(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-for-listing"
-	createTestBucket(hc, bktName)
-
-	objects := []string{"b/a/c", "b/a/g", "b/a/r", "g"}
-	for _, objName := range objects {
-		putObject(hc, bktName, objName)
-	}
-
-	response := listObjectsV2(hc, bktName, "b", "z", "", "", -1)
-
-	require.Len(t, response.Contents, 3)
-	require.Equal(t, "b/a/c", response.Contents[0].Key)
-	require.Equal(t, "b/a/g", response.Contents[1].Key)
-	require.Equal(t, "b/a/r", response.Contents[2].Key)
-	require.Empty(t, response.CommonPrefixes)
-}
-
-func TestS3BucketListV2PrefixDelimiterPrefixDelimiterNotExist(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-for-listing"
-	createTestBucket(hc, bktName)
-
-	objects := []string{"b/a/c", "b/a/g", "b/a/r", "g"}
-	for _, objName := range objects {
-		putObject(hc, bktName, objName)
-	}
-
-	response := listObjectsV2(hc, bktName, "y", "z", "", "", -1)
-
-	require.Empty(t, response.Contents)
-	require.Empty(t, response.CommonPrefixes)
-}
-
 func TestS3BucketListV2DelimiterPercentage(t *testing.T) {
 	tc := prepareHandlerContext(t)
 
@@ -525,35 +182,6 @@ func TestS3BucketListV2DelimiterPercentage(t *testing.T) {
 	require.Equal(t, "c%", listV2Response.CommonPrefixes[1].Prefix)
 }
 
-func TestS3BucketListDelimiterPrefix(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-for-listing"
-	bktInfo := createTestBucket(hc, bktName)
-
-	objects := []string{"asdf", "boo/bar", "boo/baz/xyzzy", "cquux/thud", "cquux/bla"}
-	for _, objName := range objects {
-		createTestObject(hc, bktInfo, objName, encryption.Params{})
-	}
-
-	var empty []string
-	delim := "/"
-	prefix := ""
-
-	marker := validateListV1(t, hc, bktName, prefix, delim, "", 1, true, []string{"asdf"}, empty, "asdf")
-	marker = validateListV1(t, hc, bktName, prefix, delim, marker, 1, true, empty, []string{"boo/"}, "boo/")
-	validateListV1(t, hc, bktName, prefix, delim, marker, 1, false, empty, []string{"cquux/"}, "")
-
-	marker = validateListV1(t, hc, bktName, prefix, delim, "", 2, true, []string{"asdf"}, []string{"boo/"}, "boo/")
-	validateListV1(t, hc, bktName, prefix, delim, marker, 2, false, empty, []string{"cquux/"}, "")
-
-	prefix = "boo/"
-	marker = validateListV1(t, hc, bktName, prefix, delim, "", 1, true, []string{"boo/bar"}, empty, "boo/bar")
-	validateListV1(t, hc, bktName, prefix, delim, marker, 1, false, empty, []string{"boo/baz/"}, "")
-
-	validateListV1(t, hc, bktName, prefix, delim, "", 2, false, []string{"boo/bar"}, []string{"boo/baz/"}, "")
-}
-
 func TestS3BucketListV2DelimiterPrefix(t *testing.T) {
 	tc := prepareHandlerContext(t)
 
@@ -583,65 +211,6 @@ func TestS3BucketListV2DelimiterPrefix(t *testing.T) {
 	validateListV2(t, tc, bktName, prefix, delim, "", 2, false, true, []string{"boo/bar"}, []string{"boo/baz/"})
 }
 
-func TestS3BucketListDelimiterPrefixUnderscore(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-for-listing"
-	bktInfo := createTestBucket(hc, bktName)
-
-	objects := []string{"_obj1_", "_under1/bar", "_under1/baz/xyzzy", "_under2/thud", "_under2/bla"}
-	for _, objName := range objects {
-		createTestObject(hc, bktInfo, objName, encryption.Params{})
-	}
-
-	var empty []string
-	delim := "/"
-	prefix := ""
-
-	marker := validateListV1(t, hc, bktName, prefix, delim, "", 1, true, []string{"_obj1_"}, empty, "_obj1_")
-	marker = validateListV1(t, hc, bktName, prefix, delim, marker, 1, true, empty, []string{"_under1/"}, "_under1/")
-	validateListV1(t, hc, bktName, prefix, delim, marker, 1, false, empty, []string{"_under2/"}, "")
-
-	marker = validateListV1(t, hc, bktName, prefix, delim, "", 2, true, []string{"_obj1_"}, []string{"_under1/"}, "_under1/")
-	validateListV1(t, hc, bktName, prefix, delim, marker, 2, false, empty, []string{"_under2/"}, "")
-
-	prefix = "_under1/"
-	marker = validateListV1(t, hc, bktName, prefix, delim, "", 1, true, []string{"_under1/bar"}, empty, "_under1/bar")
-	validateListV1(t, hc, bktName, prefix, delim, marker, 1, false, empty, []string{"_under1/baz/"}, "")
-
-	validateListV1(t, hc, bktName, prefix, delim, "", 2, false, []string{"_under1/bar"}, []string{"_under1/baz/"}, "")
-}
-
-func TestS3BucketListDelimiterNotSkipSpecial(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName := "bucket-for-listing"
-	bktInfo := createTestBucket(hc, bktName)
-
-	objects := []string{"0/"}
-	for i := 1000; i < 1999; i++ {
-		objects = append(objects, fmt.Sprintf("0/%d", i))
-	}
-
-	objects2 := []string{"1999", "1999#", "1999+", "2000"}
-	objects = append(objects, objects2...)
-
-	for _, objName := range objects {
-		createTestObject(hc, bktInfo, objName, encryption.Params{})
-	}
-
-	delimiter := "/"
-	list := listObjectsV1(hc, bktName, "", delimiter, "", -1)
-
-	require.Equal(t, delimiter, list.Delimiter)
-	require.Equal(t, []CommonPrefix{{Prefix: "0/"}}, list.CommonPrefixes)
-
-	require.Len(t, list.Contents, len(objects2))
-	for i := 0; i < len(list.Contents); i++ {
-		require.Equal(t, objects2[i], list.Contents[i].Key)
-	}
-}
-
 func TestMintVersioningListObjectVersionsVersionIDContinuation(t *testing.T) {
 	hc := prepareHandlerContext(t)
 
@@ -663,16 +232,12 @@ func TestMintVersioningListObjectVersionsVersionIDContinuation(t *testing.T) {
 	checkVersionsNames(t, page1, objects)
 	require.Equal(t, page1.Version[maxKeys-1].VersionID, page1.NextVersionIDMarker)
 	require.True(t, page1.IsTruncated)
-	require.Empty(t, page1.KeyMarker)
-	require.Empty(t, page1.VersionIDMarker)
 
 	page2 := listObjectsVersions(hc, bktName, "", "", page1.NextKeyMarker, page1.NextVersionIDMarker, maxKeys)
 	require.Len(t, page2.Version, maxKeys)
 	checkVersionsNames(t, page1, objects)
 	require.Empty(t, page2.NextVersionIDMarker)
 	require.False(t, page2.IsTruncated)
-	require.Equal(t, page1.NextKeyMarker, page2.KeyMarker)
-	require.Equal(t, page1.NextVersionIDMarker, page2.VersionIDMarker)
 }
 
 func checkVersionsNames(t *testing.T, versions *ListObjectsVersionsResponse, names []string) {
@@ -682,21 +247,13 @@ func checkVersionsNames(t *testing.T, versions *ListObjectsVersionsResponse, nam
 }
 
 func listObjectsV2(hc *handlerContext, bktName, prefix, delimiter, startAfter, continuationToken string, maxKeys int) *ListObjectsV2Response {
-	return listObjectsV2Ext(hc, bktName, prefix, delimiter, startAfter, continuationToken, "", maxKeys)
-}
-
-func listObjectsV2Ext(hc *handlerContext, bktName, prefix, delimiter, startAfter, continuationToken, encodingType string, maxKeys int) *ListObjectsV2Response {
 	query := prepareCommonListObjectsQuery(prefix, delimiter, maxKeys)
-	query.Add("fetch-owner", "true")
 	if len(startAfter) != 0 {
 		query.Add("start-after", startAfter)
 	}
 	if len(continuationToken) != 0 {
 		query.Add("continuation-token", continuationToken)
 	}
-	if len(encodingType) != 0 {
-		query.Add("encoding-type", encodingType)
-	}
 
 	w, r := prepareTestFullRequest(hc, bktName, "", query, nil)
 	hc.Handler().ListObjectsV2Handler(w, r)
@@ -706,26 +263,6 @@ func listObjectsV2Ext(hc *handlerContext, bktName, prefix, delimiter, startAfter
 	return res
 }
 
-func validateListV1(t *testing.T, tc *handlerContext, bktName, prefix, delimiter, marker string, maxKeys int,
-	isTruncated bool, checkObjects, checkPrefixes []string, nextMarker string) string {
-	response := listObjectsV1(tc, bktName, prefix, delimiter, marker, maxKeys)
-
-	require.Equal(t, isTruncated, response.IsTruncated)
-	require.Equal(t, nextMarker, response.NextMarker)
-
-	require.Len(t, response.Contents, len(checkObjects))
-	for i := 0; i < len(checkObjects); i++ {
-		require.Equal(t, checkObjects[i], response.Contents[i].Key)
-	}
-
-	require.Len(t, response.CommonPrefixes, len(checkPrefixes))
-	for i := 0; i < len(checkPrefixes); i++ {
-		require.Equal(t, checkPrefixes[i], response.CommonPrefixes[i].Prefix)
-	}
-
-	return response.NextMarker
-}
-
 func validateListV2(t *testing.T, tc *handlerContext, bktName, prefix, delimiter, continuationToken string, maxKeys int,
 	isTruncated, last bool, checkObjects, checkPrefixes []string) string {
 	response := listObjectsV2(tc, bktName, prefix, delimiter, "", continuationToken, maxKeys)

api/handler/put.go

@@ -238,17 +238,16 @@ func (h *handler) PutObjectHandler(w http.ResponseWriter, r *http.Request) {
 	}
 
 	params := &layer.PutObjectParams{
-		BktInfo:           bktInfo,
-		Object:            reqInfo.ObjectName,
-		Reader:            body,
-		Size:              size,
-		Header:            metadata,
-		Encryption:        encryptionParams,
-		ContentMD5:        r.Header.Get(api.ContentMD5),
-		ContentSHA256Hash: r.Header.Get(api.AmzContentSha256),
+		BktInfo:    bktInfo,
+		Object:     reqInfo.ObjectName,
+		Reader:     body,
+		Size:       size,
+		Header:     metadata,
+		Encryption: encryptionParams,
+		ContentMD5: r.Header.Get(api.ContentMD5),
 	}
 
-	params.CopiesNumbers, err = h.pickCopiesNumbers(metadata, reqInfo.Namespace, bktInfo.LocationConstraint)
+	params.CopiesNumbers, err = h.pickCopiesNumbers(metadata, bktInfo.LocationConstraint)
 	if err != nil {
 		h.logAndSendError(w, "invalid copies number", reqInfo, err)
 		return
@@ -277,7 +276,7 @@ func (h *handler) PutObjectHandler(w http.ResponseWriter, r *http.Request) {
 
 	s := &SendNotificationParams{
 		Event:            EventObjectCreatedPut,
-		NotificationInfo: data.NotificationInfoFromObject(objInfo, h.cfg.MD5Enabled()),
+		NotificationInfo: data.NotificationInfoFromObject(objInfo),
 		BktInfo:          bktInfo,
 		ReqInfo:          reqInfo,
 	}
@@ -328,7 +327,7 @@ func (h *handler) PutObjectHandler(w http.ResponseWriter, r *http.Request) {
 		addSSECHeaders(w.Header(), r.Header)
 	}
 
-	w.Header().Set(api.ETag, data.Quote(objInfo.ETag(h.cfg.MD5Enabled())))
+	w.Header().Set(api.ETag, objInfo.ETag(h.cfg.MD5Enabled()))
 
 	middleware.WriteSuccessResponseHeadersOnly(w)
 }
@@ -523,7 +522,7 @@ func (h *handler) PostObject(w http.ResponseWriter, r *http.Request) {
 
 	s := &SendNotificationParams{
 		Event:            EventObjectCreatedPost,
-		NotificationInfo: data.NotificationInfoFromObject(objInfo, h.cfg.MD5Enabled()),
+		NotificationInfo: data.NotificationInfoFromObject(objInfo),
 		BktInfo:          bktInfo,
 		ReqInfo:          reqInfo,
 	}
@@ -592,7 +591,7 @@ func (h *handler) PostObject(w http.ResponseWriter, r *http.Request) {
 			resp := &PostResponse{
 				Bucket: objInfo.Bucket,
 				Key:    objInfo.Name,
-				ETag:   data.Quote(objInfo.ETag(h.cfg.MD5Enabled())),
+				ETag:   objInfo.ETag(h.cfg.MD5Enabled()),
 			}
 			w.WriteHeader(status)
 			if _, err = w.Write(middleware.EncodeResponse(resp)); err != nil {
@@ -602,7 +601,7 @@ func (h *handler) PostObject(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	w.Header().Set(api.ETag, data.Quote(objInfo.ETag(h.cfg.MD5Enabled())))
+	w.Header().Set(api.ETag, objInfo.HashSum)
 	w.WriteHeader(status)
 }
 
@@ -748,8 +747,7 @@ func (h *handler) CreateBucketHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	reqInfo := middleware.GetReqInfo(ctx)
 	p := &layer.CreateBucketParams{
-		Name:      reqInfo.BucketName,
-		Namespace: reqInfo.Namespace,
+		Name: reqInfo.BucketName,
 	}
 
 	if err := checkBucketName(reqInfo.BucketName); err != nil {
@@ -800,7 +798,7 @@ func (h *handler) CreateBucketHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err = h.setPolicy(p, reqInfo.Namespace, createParams.LocationConstraint, policies); err != nil {
+	if err = h.setPolicy(p, createParams.LocationConstraint, policies); err != nil {
 		h.logAndSendError(w, "couldn't set placement policy", reqInfo, err)
 		return
 	}
@@ -830,8 +828,8 @@ func (h *handler) CreateBucketHandler(w http.ResponseWriter, r *http.Request) {
 	middleware.WriteSuccessResponseHeadersOnly(w)
 }
 
-func (h handler) setPolicy(prm *layer.CreateBucketParams, namespace, locationConstraint string, userPolicies []*accessbox.ContainerPolicy) error {
-	prm.Policy = h.cfg.DefaultPlacementPolicy(namespace)
+func (h handler) setPolicy(prm *layer.CreateBucketParams, locationConstraint string, userPolicies []*accessbox.ContainerPolicy) error {
+	prm.Policy = h.cfg.DefaultPlacementPolicy()
 	prm.LocationConstraint = locationConstraint
 
 	if locationConstraint == "" {
@@ -845,7 +843,7 @@ func (h handler) setPolicy(prm *layer.CreateBucketParams, namespace, locationCon
 		}
 	}
 
-	if policy, ok := h.cfg.PlacementPolicy(namespace, locationConstraint); ok {
+	if policy, ok := h.cfg.PlacementPolicy(locationConstraint); ok {
 		prm.Policy = policy
 		return nil
 	}

api/handler/put_test.go

@@ -17,8 +17,8 @@ import (
 	"time"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api"
+	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/auth"
 	v4 "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/auth/signer/v4"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
 	s3errors "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/layer"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/middleware"
@@ -204,64 +204,7 @@ func TestPutObjectWithEnabledMD5(t *testing.T) {
 	md5Hash.Write(content)
 	w, r := prepareTestPayloadRequest(tc, bktName, objName, bytes.NewReader(content))
 	tc.Handler().PutObjectHandler(w, r)
-	require.Equal(t, data.Quote(hex.EncodeToString(md5Hash.Sum(nil))), w.Header().Get(api.ETag))
-}
-
-func TestPutObjectCheckContentSHA256(t *testing.T) {
-	hc := prepareHandlerContext(t)
-
-	bktName, objName := "bucket-for-put", "object-for-put"
-	createTestBucket(hc, bktName)
-
-	for _, tc := range []struct {
-		name    string
-		hash    string
-		content []byte
-		error   bool
-	}{
-		{
-			name:    "invalid hash value",
-			hash:    "d1b2a59fbea7e20077af9f91b27e95e865061b270be03ff539ab3b73587882e8",
-			content: []byte("content"),
-			error:   true,
-		},
-		{
-			name:    "correct hash for empty payload",
-			hash:    "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-			content: []byte(""),
-			error:   false,
-		},
-		{
-			name:    "unsigned payload",
-			hash:    "UNSIGNED-PAYLOAD",
-			content: []byte("content"),
-			error:   false,
-		},
-		{
-			name:    "correct hash",
-			hash:    "ed7002b439e9ac845f22357d822bac1444730fbdb6016d3ec9432297b9ec9f73",
-			content: []byte("content"),
-			error:   false,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			w, r := prepareTestPayloadRequest(hc, bktName, objName, bytes.NewReader(tc.content))
-			r.Header.Set("X-Amz-Content-Sha256", tc.hash)
-			hc.Handler().PutObjectHandler(w, r)
-
-			if tc.error {
-				assertS3Error(t, w, s3errors.GetAPIError(s3errors.ErrContentSHA256Mismatch))
-
-				w, r := prepareTestRequest(hc, bktName, objName, nil)
-				hc.Handler().GetObjectHandler(w, r)
-
-				assertStatus(t, w, http.StatusNotFound)
-				return
-			}
-
-			assertStatus(t, w, http.StatusOK)
-		})
-	}
+	require.Equal(t, hex.EncodeToString(md5Hash.Sum(nil)), w.Header().Get(api.ETag))
 }
 
 func TestPutObjectWithStreamBodyAWSExample(t *testing.T) {
@@ -354,9 +297,10 @@ func getChunkedRequest(ctx context.Context, t *testing.T, bktName, objName strin
 	reqInfo := middleware.NewReqInfo(w, req, middleware.ObjectRequest{Bucket: bktName, Object: objName})
 	req = req.WithContext(middleware.SetReqInfo(ctx, reqInfo))
 	req = req.WithContext(middleware.SetClientTime(req.Context(), signTime))
-	req = req.WithContext(middleware.SetAuthHeaders(req.Context(), &middleware.AuthHeader{
+	req = req.WithContext(middleware.SetAuthHeaders(req.Context(), &auth.AuthHeader{
 		AccessKeyID: AWSAccessKeyID,
 		SignatureV4: "4f232c4386841ef735655705268965c44a0e4690baa4adea153f7db9fa80a0a9",
+		Service:     "s3",
 		Region:      "us-east-1",
 	}))
 	req = req.WithContext(middleware.SetBoxData(req.Context(), &accessbox.Box{
@@ -380,26 +324,6 @@ func TestCreateBucket(t *testing.T) {
 	createBucketAssertS3Error(hc, bktName, box2, s3errors.ErrBucketAlreadyExists)
 }
 
-func TestCreateNamespacedBucket(t *testing.T) {
-	hc := prepareHandlerContext(t)
-	bktName := "bkt-name"
-	namespace := "yabloko"
-
-	box, _ := createAccessBox(t)
-	w, r := prepareTestRequest(hc, bktName, "", nil)
-	ctx := middleware.SetBoxData(r.Context(), box)
-	reqInfo := middleware.GetReqInfo(ctx)
-	reqInfo.Namespace = namespace
-	r = r.WithContext(middleware.SetReqInfo(ctx, reqInfo))
-	hc.Handler().CreateBucketHandler(w, r)
-	assertStatus(t, w, http.StatusOK)
-
-	bktInfo, err := hc.Layer().GetBucketInfo(middleware.SetReqInfo(hc.Context(), reqInfo), bktName)
-	require.NoError(t, err)
-
-	require.Equal(t, namespace+".ns", bktInfo.Zone)
-}
-
 func TestPutObjectClientCut(t *testing.T) {
 	hc := prepareHandlerContext(t)
 	bktName, objName1, objName2 := "bkt-name", "obj-name1", "obj-name2"

api/layer/cache.go

@@ -11,14 +11,13 @@ import (
 )
 
 type Cache struct {
-	logger           *zap.Logger
-	listsCache       *cache.ObjectsListCache
-	sessionListCache *cache.ListSessionCache
-	objCache         *cache.ObjectsCache
-	namesCache       *cache.ObjectsNameCache
-	bucketCache      *cache.BucketCache
-	systemCache      *cache.SystemCache
-	accessCache      *cache.AccessControlCache
+	logger      *zap.Logger
+	listsCache  *cache.ObjectsListCache
+	objCache    *cache.ObjectsCache
+	namesCache  *cache.ObjectsNameCache
+	bucketCache *cache.BucketCache
+	systemCache *cache.SystemCache
+	accessCache *cache.AccessControlCache
 }
 
 // CachesConfig contains params for caches.
@@ -26,7 +25,6 @@ type CachesConfig struct {
 	Logger        *zap.Logger
 	Objects       *cache.Config
 	ObjectsList   *cache.Config
-	SessionList   *cache.Config
 	Names         *cache.Config
 	Buckets       *cache.Config
 	System        *cache.Config
@@ -39,7 +37,6 @@ func DefaultCachesConfigs(logger *zap.Logger) *CachesConfig {
 		Logger:        logger,
 		Objects:       cache.DefaultObjectsConfig(logger),
 		ObjectsList:   cache.DefaultObjectsListConfig(logger),
-		SessionList:   cache.DefaultListSessionConfig(logger),
 		Names:         cache.DefaultObjectsNameConfig(logger),
 		Buckets:       cache.DefaultBucketConfig(logger),
 		System:        cache.DefaultSystemConfig(logger),
@@ -49,33 +46,31 @@ func DefaultCachesConfigs(logger *zap.Logger) *CachesConfig {
 
 func NewCache(cfg *CachesConfig) *Cache {
 	return &Cache{
-		logger:           cfg.Logger,
-		listsCache:       cache.NewObjectsListCache(cfg.ObjectsList),
-		sessionListCache: cache.NewListSessionCache(cfg.SessionList),
-		objCache:         cache.New(cfg.Objects),
-		namesCache:       cache.NewObjectsNameCache(cfg.Names),
-		bucketCache:      cache.NewBucketCache(cfg.Buckets),
-		systemCache:      cache.NewSystemCache(cfg.System),
-		accessCache:      cache.NewAccessControlCache(cfg.AccessControl),
+		logger:      cfg.Logger,
+		listsCache:  cache.NewObjectsListCache(cfg.ObjectsList),
+		objCache:    cache.New(cfg.Objects),
+		namesCache:  cache.NewObjectsNameCache(cfg.Names),
+		bucketCache: cache.NewBucketCache(cfg.Buckets),
+		systemCache: cache.NewSystemCache(cfg.System),
+		accessCache: cache.NewAccessControlCache(cfg.AccessControl),
 	}
 }
 
-func (c *Cache) GetBucket(ns, name string) *data.BucketInfo {
-	return c.bucketCache.Get(ns, name)
+func (c *Cache) GetBucket(name string) *data.BucketInfo {
+	return c.bucketCache.Get(name)
 }
 
 func (c *Cache) PutBucket(bktInfo *data.BucketInfo) {
 	if err := c.bucketCache.Put(bktInfo); err != nil {
 		c.logger.Warn(logs.CouldntPutBucketInfoIntoCache,
-			zap.String("zone", bktInfo.Zone),
 			zap.String("bucket name", bktInfo.Name),
 			zap.Stringer("bucket cid", bktInfo.CID),
 			zap.Error(err))
 	}
 }
 
-func (c *Cache) DeleteBucket(bktInfo *data.BucketInfo) {
-	c.bucketCache.Delete(bktInfo)
+func (c *Cache) DeleteBucket(name string) {
+	c.bucketCache.Delete(name)
 }
 
 func (c *Cache) CleanListCacheEntriesContainingObject(objectName string, cnrID cid.ID) {
@@ -148,29 +143,6 @@ func (c *Cache) PutList(owner user.ID, key cache.ObjectsListKey, list []*data.No
 	}
 }
 
-func (c *Cache) GetListSession(owner user.ID, key cache.ListSessionKey) *data.ListSession {
-	if !c.accessCache.Get(owner, key.String()) {
-		return nil
-	}
-
-	return c.sessionListCache.GetListSession(key)
-}
-
-func (c *Cache) PutListSession(owner user.ID, key cache.ListSessionKey, session *data.ListSession) {
-	if err := c.sessionListCache.PutListSession(key, session); err != nil {
-		c.logger.Warn(logs.CouldntCacheListSession, zap.Error(err))
-	}
-
-	if err := c.accessCache.Put(owner, key.String()); err != nil {
-		c.logger.Warn(logs.CouldntCacheAccessControlOperation, zap.Error(err))
-	}
-}
-
-func (c *Cache) DeleteListSession(owner user.ID, key cache.ListSessionKey) {
-	c.sessionListCache.DeleteListSession(key)
-	c.accessCache.Delete(owner, key.String())
-}
-
 func (c *Cache) GetTagging(owner user.ID, key string) map[string]string {
 	if !c.accessCache.Get(owner, key) {
 		return nil

api/layer/container.go

@@ -5,10 +5,10 @@ import (
 	"fmt"
 	"strconv"
 
+	v2container "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/container"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
 	s3errors "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/middleware"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
@@ -41,8 +41,6 @@ func (n *layer) containerInfo(ctx context.Context, idCnr cid.ID) (*data.BucketIn
 			CID:  idCnr,
 			Name: idCnr.EncodeToString(),
 		}
-
-		reqInfo = middleware.GetReqInfo(ctx)
 	)
 	res, err = n.frostFS.Container(ctx, idCnr)
 	if err != nil {
@@ -74,11 +72,6 @@ func (n *layer) containerInfo(ctx context.Context, idCnr cid.ID) (*data.BucketIn
 		}
 	}
 
-	zone, _ := n.features.FormContainerZone(reqInfo.Namespace)
-	if zone != info.Zone {
-		return nil, fmt.Errorf("ns '%s' and zone '%s' are mismatched for container '%s'", zone, info.Zone, idCnr)
-	}
-
 	n.cache.PutBucket(info)
 
 	return info, nil
@@ -109,12 +102,9 @@ func (n *layer) createContainer(ctx context.Context, p *CreateBucketParams) (*da
 	if p.LocationConstraint == "" {
 		p.LocationConstraint = api.DefaultLocationConstraint // s3tests_boto3.functional.test_s3:test_bucket_get_location
 	}
-
-	zone, _ := n.features.FormContainerZone(p.Namespace)
-
 	bktInfo := &data.BucketInfo{
 		Name:               p.Name,
-		Zone:               zone,
+		Zone:               v2container.SysAttributeZoneDefault,
 		Owner:              n.BearerOwner(ctx),
 		Created:            TimeNow(ctx),
 		LocationConstraint: p.LocationConstraint,
@@ -137,7 +127,6 @@ func (n *layer) createContainer(ctx context.Context, p *CreateBucketParams) (*da
 		Creator:              bktInfo.Owner,
 		Policy:               p.Policy,
 		Name:                 p.Name,
-		Zone:                 zone,
 		SessionToken:         p.SessionContainerCreation,
 		CreationTime:         bktInfo.Created,
 		AdditionalAttributes: attributes,

api/layer/frostfs.go

@@ -30,9 +30,6 @@ type PrmContainerCreate struct {
 	// Name for the container.
 	Name string
 
-	// Zone for container registration.
-	Zone string
-
 	// CreationTime value for Timestamp attribute
 	CreationTime time.Time
 

api/layer/frostfs_mock.go

@@ -10,7 +10,6 @@ import (
 	"io"
 	"time"
 
-	v2container "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/container"
 	objectv2 "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/object"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/middleware"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
@@ -51,14 +50,6 @@ func (k *FeatureSettingsMock) SetMD5Enabled(md5Enabled bool) {
 	k.md5Enabled = md5Enabled
 }
 
-func (k *FeatureSettingsMock) FormContainerZone(ns string) (zone string, isDefault bool) {
-	if ns == "" {
-		return v2container.SysAttributeZoneDefault, true
-	}
-
-	return ns + ".ns", false
-}
-
 type TestFrostFS struct {
 	FrostFS
 
@@ -152,7 +143,6 @@ func (t *TestFrostFS) CreateContainer(_ context.Context, prm PrmContainerCreate)
 	if prm.Name != "" {
 		var d container.Domain
 		d.SetName(prm.Name)
-		d.SetZone(prm.Zone)
 
 		container.WriteDomain(&cnr, d)
 		container.SetName(&cnr, prm.Name)

api/layer/layer.go

@@ -51,7 +51,6 @@ type (
 		ClientCut() bool
 		BufferMaxSizeForPut() uint64
 		MD5Enabled() bool
-		FormContainerZone(ns string) (zone string, isDefault bool)
 	}
 
 	layer struct {
@@ -69,7 +68,7 @@ type (
 	Config struct {
 		GateOwner    user.ID
 		ChainAddress string
-		Cache        *Cache
+		Caches       *CachesConfig
 		AnonKey      AnonymousKey
 		Resolver     BucketResolver
 		TreeService  TreeService
@@ -113,17 +112,16 @@ type (
 
 	// PutObjectParams stores object put request parameters.
 	PutObjectParams struct {
-		BktInfo           *data.BucketInfo
-		Object            string
-		Size              uint64
-		Reader            io.Reader
-		Header            map[string]string
-		Lock              *data.ObjectLock
-		Encryption        encryption.Params
-		CopiesNumbers     []uint32
-		CompleteMD5Hash   string
-		ContentMD5        string
-		ContentSHA256Hash string
+		BktInfo         *data.BucketInfo
+		Object          string
+		Size            uint64
+		Reader          io.Reader
+		Header          map[string]string
+		Lock            *data.ObjectLock
+		Encryption      encryption.Params
+		CopiesNumbers   []uint32
+		CompleteMD5Hash string
+		ContentMD5      string
 	}
 
 	PutCombinedObjectParams struct {
@@ -173,7 +171,6 @@ type (
 	// CreateBucketParams stores bucket create request parameters.
 	CreateBucketParams struct {
 		Name                     string
-		Namespace                string
 		Policy                   netmap.PlacementPolicy
 		EACL                     *eacl.Table
 		SessionContainerCreation *session.Container
@@ -323,7 +320,7 @@ func NewLayer(log *zap.Logger, frostFS FrostFS, config *Config) Client {
 		gateOwner:   config.GateOwner,
 		anonKey:     config.AnonKey,
 		resolver:    config.Resolver,
-		cache:       config.Cache,
+		cache:       NewCache(config.Caches),
 		treeService: config.TreeService,
 		features:    config.Features,
 	}
@@ -403,9 +400,7 @@ func (n *layer) GetBucketInfo(ctx context.Context, name string) (*data.BucketInf
 		return nil, fmt.Errorf("unescape bucket name: %w", err)
 	}
 
-	reqInfo := middleware.GetReqInfo(ctx)
-
-	if bktInfo := n.cache.GetBucket(reqInfo.Namespace, name); bktInfo != nil {
+	if bktInfo := n.cache.GetBucket(name); bktInfo != nil {
 		return bktInfo, nil
 	}
 
@@ -651,7 +646,7 @@ func (n *layer) deleteObject(ctx context.Context, bkt *data.BucketInfo, settings
 
 		var nullVersionToDelete *data.NodeVersion
 		if lastVersion.IsUnversioned {
-			if !lastVersion.IsDeleteMarker {
+			if !lastVersion.IsDeleteMarker() {
 				nullVersionToDelete = lastVersion
 			}
 		} else if nullVersionToDelete, obj.Error = n.getNodeVersionToDelete(ctx, bkt, obj); obj.Error != nil {
@@ -667,7 +662,7 @@ func (n *layer) deleteObject(ctx context.Context, bkt *data.BucketInfo, settings
 		}
 	}
 
-	if lastVersion.IsDeleteMarker {
+	if lastVersion.IsDeleteMarker() {
 		obj.DeleteMarkVersion = lastVersion.OID.EncodeToString()
 		return obj
 	}
@@ -679,14 +674,15 @@ func (n *layer) deleteObject(ctx context.Context, bkt *data.BucketInfo, settings
 	}
 
 	obj.DeleteMarkVersion = randOID.EncodeToString()
-	now := TimeNow(ctx)
+
 	newVersion := &data.NodeVersion{
 		BaseNodeVersion: data.BaseNodeVersion{
-			OID:            randOID,
-			FilePath:       obj.Name,
-			Created:        &now,
-			Owner:          &n.gateOwner,
-			IsDeleteMarker: true,
+			OID:      randOID,
+			FilePath: obj.Name,
+		},
+		DeleteMarker: &data.DeleteMarkerInfo{
+			Created: TimeNow(ctx),
+			Owner:   n.gateOwner,
 		},
 		IsUnversioned: settings.VersioningSuspended(),
 	}
@@ -711,15 +707,24 @@ func (n *layer) handleNotFoundError(bkt *data.BucketInfo, obj *VersionedObject)
 }
 
 func (n *layer) handleObjectDeleteErrors(ctx context.Context, bkt *data.BucketInfo, obj *VersionedObject, nodeID uint64) *VersionedObject {
-	if !client.IsErrObjectAlreadyRemoved(obj.Error) && !client.IsErrObjectNotFound(obj.Error) {
-		return obj
+	if client.IsErrObjectAlreadyRemoved(obj.Error) {
+		n.reqLogger(ctx).Debug(logs.ObjectAlreadyRemoved,
+			zap.Stringer("cid", bkt.CID), zap.String("oid", obj.VersionID))
+
+		obj.Error = n.treeService.RemoveVersion(ctx, bkt, nodeID)
+		if obj.Error != nil {
+			return obj
+		}
+
+		n.cache.DeleteObjectName(bkt.CID, bkt.Name, obj.Name)
 	}
 
-	n.reqLogger(ctx).Debug(logs.CouldntDeleteObjectFromStorageContinueDeleting,
-		zap.Stringer("cid", bkt.CID), zap.String("oid", obj.VersionID), zap.Error(obj.Error))
+	if client.IsErrObjectNotFound(obj.Error) {
+		n.reqLogger(ctx).Debug(logs.ObjectNotFound,
+			zap.Stringer("cid", bkt.CID), zap.String("oid", obj.VersionID))
+
+		obj.Error = nil
 
-	obj.Error = n.treeService.RemoveVersion(ctx, bkt, nodeID)
-	if obj.Error == nil {
 		n.cache.DeleteObjectName(bkt.CID, bkt.Name, obj.Name)
 	}
 
@@ -754,7 +759,7 @@ func (n *layer) getLastNodeVersion(ctx context.Context, bkt *data.BucketInfo, ob
 }
 
 func (n *layer) removeOldVersion(ctx context.Context, bkt *data.BucketInfo, nodeVersion *data.NodeVersion, obj *VersionedObject) (string, error) {
-	if nodeVersion.IsDeleteMarker {
+	if nodeVersion.IsDeleteMarker() {
 		return obj.VersionID, nil
 	}
 
@@ -800,18 +805,14 @@ func (n *layer) ResolveBucket(ctx context.Context, name string) (cid.ID, error)
 }
 
 func (n *layer) DeleteBucket(ctx context.Context, p *DeleteBucketParams) error {
-	res, _, err := n.getAllObjectsVersions(ctx, commonVersionsListingParams{
-		BktInfo: p.BktInfo,
-		MaxKeys: 1,
-	})
-
+	nodeVersions, err := n.getAllObjectsVersions(ctx, p.BktInfo, "", "")
 	if err != nil {
 		return err
 	}
-	if len(res) != 0 {
+	if len(nodeVersions) != 0 {
 		return errors.GetAPIError(errors.ErrBucketNotEmpty)
 	}
 
-	n.cache.DeleteBucket(p.BktInfo)
+	n.cache.DeleteBucket(p.BktInfo.Name)
 	return n.frostFS.DeleteContainer(ctx, p.BktInfo.CID, p.SessionToken)
 }

api/layer/listing.go

@@ -1,725 +0,0 @@
-package layer
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"sort"
-	"strings"
-	"sync"
-
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/cache"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
-	s3errors "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/middleware"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
-	"github.com/panjf2000/ants/v2"
-	"go.uber.org/zap"
-)
-
-type (
-	// ListObjectsParamsCommon contains common parameters for ListObjectsV1 and ListObjectsV2.
-	ListObjectsParamsCommon struct {
-		BktInfo   *data.BucketInfo
-		Delimiter string
-		Encode    string
-		MaxKeys   int
-		Prefix    string
-	}
-
-	// ListObjectsParamsV1 contains params for ListObjectsV1.
-	ListObjectsParamsV1 struct {
-		ListObjectsParamsCommon
-		Marker string
-	}
-
-	// ListObjectsParamsV2 contains params for ListObjectsV2.
-	ListObjectsParamsV2 struct {
-		ListObjectsParamsCommon
-		ContinuationToken string
-		StartAfter        string
-		FetchOwner        bool
-	}
-
-	// ListObjectsInfo contains common fields of data for ListObjectsV1 and ListObjectsV2.
-	ListObjectsInfo struct {
-		Prefixes    []string
-		Objects     []*data.ExtendedNodeVersion
-		IsTruncated bool
-	}
-
-	// ListObjectsInfoV1 holds data which ListObjectsV1 returns.
-	ListObjectsInfoV1 struct {
-		ListObjectsInfo
-		NextMarker string
-	}
-
-	// ListObjectsInfoV2 holds data which ListObjectsV2 returns.
-	ListObjectsInfoV2 struct {
-		ListObjectsInfo
-		NextContinuationToken string
-	}
-
-	// ListObjectVersionsInfo stores info and list of objects versions.
-	ListObjectVersionsInfo struct {
-		CommonPrefixes      []string
-		IsTruncated         bool
-		KeyMarker           string
-		NextKeyMarker       string
-		NextVersionIDMarker string
-		Version             []*data.ExtendedNodeVersion
-		DeleteMarker        []*data.ExtendedNodeVersion
-		VersionIDMarker     string
-	}
-
-	commonVersionsListingParams struct {
-		BktInfo   *data.BucketInfo
-		Delimiter string
-		Prefix    string
-		MaxKeys   int
-		Marker    string
-		Bookmark  string
-	}
-
-	commonLatestVersionsListingParams struct {
-		commonVersionsListingParams
-		ListType ListType
-	}
-)
-
-type ListType int
-
-const (
-	ListObjectsV1Type ListType = iota + 1
-	ListObjectsV2Type ListType = iota + 1
-)
-
-// ListObjectsV1 returns objects in a bucket for requests of Version 1.
-func (n *layer) ListObjectsV1(ctx context.Context, p *ListObjectsParamsV1) (*ListObjectsInfoV1, error) {
-	var result ListObjectsInfoV1
-
-	prm := commonLatestVersionsListingParams{
-		commonVersionsListingParams: commonVersionsListingParams{
-			BktInfo:   p.BktInfo,
-			Delimiter: p.Delimiter,
-			Prefix:    p.Prefix,
-			MaxKeys:   p.MaxKeys,
-			Marker:    p.Marker,
-			Bookmark:  p.Marker,
-		},
-		ListType: ListObjectsV1Type,
-	}
-
-	objects, next, err := n.getLatestObjectsVersions(ctx, prm)
-	if err != nil {
-		return nil, err
-	}
-
-	if next != nil {
-		result.IsTruncated = true
-		result.NextMarker = objects[len(objects)-1].Name()
-	}
-
-	result.Prefixes, result.Objects = triageExtendedObjects(objects)
-
-	return &result, nil
-}
-
-// ListObjectsV2 returns objects in a bucket for requests of Version 2.
-func (n *layer) ListObjectsV2(ctx context.Context, p *ListObjectsParamsV2) (*ListObjectsInfoV2, error) {
-	var result ListObjectsInfoV2
-
-	prm := commonLatestVersionsListingParams{
-		commonVersionsListingParams: commonVersionsListingParams{
-			BktInfo:   p.BktInfo,
-			Delimiter: p.Delimiter,
-			Prefix:    p.Prefix,
-			MaxKeys:   p.MaxKeys,
-			Marker:    p.StartAfter,
-			Bookmark:  p.ContinuationToken,
-		},
-		ListType: ListObjectsV2Type,
-	}
-
-	objects, next, err := n.getLatestObjectsVersions(ctx, prm)
-	if err != nil {
-		return nil, err
-	}
-
-	if next != nil {
-		result.IsTruncated = true
-		result.NextContinuationToken = next.NodeVersion.OID.EncodeToString()
-	}
-
-	result.Prefixes, result.Objects = triageExtendedObjects(objects)
-
-	return &result, nil
-}
-
-func (n *layer) ListObjectVersions(ctx context.Context, p *ListObjectVersionsParams) (*ListObjectVersionsInfo, error) {
-	prm := commonVersionsListingParams{
-		BktInfo:   p.BktInfo,
-		Delimiter: p.Delimiter,
-		Prefix:    p.Prefix,
-		MaxKeys:   p.MaxKeys,
-		Marker:    p.KeyMarker,
-		Bookmark:  p.VersionIDMarker,
-	}
-
-	objects, isTruncated, err := n.getAllObjectsVersions(ctx, prm)
-	if err != nil {
-		return nil, err
-	}
-
-	res := &ListObjectVersionsInfo{
-		KeyMarker:       p.KeyMarker,
-		VersionIDMarker: p.VersionIDMarker,
-		IsTruncated:     isTruncated,
-	}
-
-	if res.IsTruncated {
-		res.NextKeyMarker = objects[p.MaxKeys-1].NodeVersion.FilePath
-		res.NextVersionIDMarker = objects[p.MaxKeys-1].NodeVersion.OID.EncodeToString()
-	}
-
-	res.CommonPrefixes, objects = triageExtendedObjects(objects)
-	res.Version, res.DeleteMarker = triageVersions(objects)
-	return res, nil
-}
-
-func (n *layer) getLatestObjectsVersions(ctx context.Context, p commonLatestVersionsListingParams) (objects []*data.ExtendedNodeVersion, next *data.ExtendedNodeVersion, err error) {
-	if p.MaxKeys == 0 {
-		return nil, nil, nil
-	}
-
-	session, err := n.getListLatestVersionsSession(ctx, p)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	generator, errorCh := nodesGeneratorStream(ctx, p.commonVersionsListingParams, session)
-	objOutCh, err := n.initWorkerPool(ctx, 2, p.commonVersionsListingParams, generator)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to init worker pool: %w", err)
-	}
-
-	objects = make([]*data.ExtendedNodeVersion, 0, p.MaxKeys+1)
-	objects = append(objects, session.Next...)
-	for obj := range objOutCh {
-		objects = append(objects, obj)
-	}
-
-	if err = <-errorCh; err != nil {
-		return nil, nil, fmt.Errorf("failed to get next object from stream: %w", err)
-	}
-
-	sort.Slice(objects, func(i, j int) bool { return objects[i].NodeVersion.FilePath < objects[j].NodeVersion.FilePath })
-
-	if len(objects) > p.MaxKeys {
-		next = objects[p.MaxKeys]
-		n.putListLatestVersionsSession(ctx, p, session, objects)
-		objects = objects[:p.MaxKeys]
-	}
-
-	return
-}
-
-func (n *layer) getAllObjectsVersions(ctx context.Context, p commonVersionsListingParams) ([]*data.ExtendedNodeVersion, bool, error) {
-	if p.MaxKeys == 0 {
-		return nil, false, nil
-	}
-
-	session, err := n.getListAllVersionsSession(ctx, p)
-	if err != nil {
-		return nil, false, err
-	}
-
-	generator, errorCh := nodesGeneratorVersions(ctx, p, session)
-	objOutCh, err := n.initWorkerPool(ctx, 2, p, generator)
-	if err != nil {
-		return nil, false, err
-	}
-
-	allObjects := handleGeneratedVersions(objOutCh, p, session)
-
-	sort.SliceStable(allObjects, func(i, j int) bool { return allObjects[i].NodeVersion.FilePath < allObjects[j].NodeVersion.FilePath })
-
-	if err = <-errorCh; err != nil {
-		return nil, false, fmt.Errorf("failed to get next object from stream: %w", err)
-	}
-
-	var isTruncated bool
-	if len(allObjects) > p.MaxKeys {
-		isTruncated = true
-		n.putListAllVersionsSession(ctx, p, session, allObjects)
-		allObjects = allObjects[:p.MaxKeys]
-	}
-
-	return allObjects, isTruncated, nil
-}
-
-func handleGeneratedVersions(objOutCh <-chan *data.ExtendedNodeVersion, p commonVersionsListingParams, session *data.ListSession) []*data.ExtendedNodeVersion {
-	var lastName string
-	var listRowStartIndex int
-	allObjects := make([]*data.ExtendedNodeVersion, 0, p.MaxKeys)
-	for eoi := range objOutCh {
-		name := eoi.NodeVersion.FilePath
-		if eoi.DirName != "" {
-			name = eoi.DirName
-		}
-
-		if lastName != name {
-			formVersionsListRow(allObjects, listRowStartIndex, session)
-			listRowStartIndex = len(allObjects)
-			allObjects = append(allObjects, eoi)
-		} else if eoi.DirName == "" {
-			allObjects = append(allObjects, eoi)
-		}
-		lastName = name
-	}
-
-	formVersionsListRow(allObjects, listRowStartIndex, session)
-
-	return allObjects
-}
-
-func formVersionsListRow(objects []*data.ExtendedNodeVersion, rowStartIndex int, session *data.ListSession) {
-	if len(objects) == 0 {
-		return
-	}
-
-	prevVersions := objects[rowStartIndex:]
-	sort.Slice(prevVersions, func(i, j int) bool {
-		return prevVersions[j].NodeVersion.Timestamp < prevVersions[i].NodeVersion.Timestamp // sort in reverse order to have last added first
-	})
-
-	prevVersions[0].IsLatest = len(session.Next) == 0 || session.Next[0].NodeVersion.FilePath != prevVersions[0].NodeVersion.FilePath
-
-	for _, version := range prevVersions[1:] {
-		version.IsLatest = false
-	}
-}
-
-func (n *layer) getListLatestVersionsSession(ctx context.Context, p commonLatestVersionsListingParams) (*data.ListSession, error) {
-	return n.getListVersionsSession(ctx, p.commonVersionsListingParams, true)
-}
-
-func (n *layer) getListAllVersionsSession(ctx context.Context, p commonVersionsListingParams) (*data.ListSession, error) {
-	return n.getListVersionsSession(ctx, p, false)
-}
-
-func (n *layer) getListVersionsSession(ctx context.Context, p commonVersionsListingParams, latestOnly bool) (*data.ListSession, error) {
-	owner := n.BearerOwner(ctx)
-
-	cacheKey := cache.CreateListSessionCacheKey(p.BktInfo.CID, p.Prefix, p.Bookmark)
-	session := n.cache.GetListSession(owner, cacheKey)
-	if session == nil {
-		return n.initNewVersionsByPrefixSession(ctx, p, latestOnly)
-	}
-
-	if session.Acquired.Swap(true) {
-		return n.initNewVersionsByPrefixSession(ctx, p, latestOnly)
-	}
-
-	// after reading next object from stream in session
-	// the current cache value already doesn't match with next token in cache key
-	n.cache.DeleteListSession(owner, cacheKey)
-
-	return session, nil
-}
-
-func (n *layer) initNewVersionsByPrefixSession(ctx context.Context, p commonVersionsListingParams, latestOnly bool) (session *data.ListSession, err error) {
-	session = &data.ListSession{NamesMap: make(map[string]struct{})}
-	session.Context, session.Cancel = context.WithCancel(context.Background())
-
-	if bd, err := middleware.GetBoxData(ctx); err == nil {
-		session.Context = middleware.SetBoxData(session.Context, bd)
-	}
-
-	session.Stream, err = n.treeService.InitVersionsByPrefixStream(session.Context, p.BktInfo, p.Prefix, latestOnly)
-	if err != nil {
-		return nil, err
-	}
-
-	return session, nil
-}
-
-func (n *layer) putListLatestVersionsSession(ctx context.Context, p commonLatestVersionsListingParams, session *data.ListSession, allObjects []*data.ExtendedNodeVersion) {
-	if len(allObjects) <= p.MaxKeys {
-		return
-	}
-
-	var cacheKey cache.ListSessionKey
-	switch p.ListType {
-	case ListObjectsV1Type:
-		cacheKey = cache.CreateListSessionCacheKey(p.BktInfo.CID, p.Prefix, allObjects[p.MaxKeys-1].Name())
-	case ListObjectsV2Type:
-		cacheKey = cache.CreateListSessionCacheKey(p.BktInfo.CID, p.Prefix, allObjects[p.MaxKeys].NodeVersion.OID.EncodeToString())
-	default:
-		// should never happen
-		panic("invalid list type")
-	}
-
-	session.Acquired.Store(false)
-	session.Next = []*data.ExtendedNodeVersion{allObjects[p.MaxKeys]}
-	n.cache.PutListSession(n.BearerOwner(ctx), cacheKey, session)
-}
-
-func (n *layer) putListAllVersionsSession(ctx context.Context, p commonVersionsListingParams, session *data.ListSession, allObjects []*data.ExtendedNodeVersion) {
-	if len(allObjects) <= p.MaxKeys {
-		return
-	}
-
-	session.Acquired.Store(false)
-
-	session.Next = make([]*data.ExtendedNodeVersion, len(allObjects)-p.MaxKeys+1)
-	session.Next[0] = allObjects[p.MaxKeys-1]
-	for i, node := range allObjects[p.MaxKeys:] {
-		session.Next[i+1] = node
-	}
-
-	cacheKey := cache.CreateListSessionCacheKey(p.BktInfo.CID, p.Prefix, session.Next[0].NodeVersion.OID.EncodeToString())
-	n.cache.PutListSession(n.BearerOwner(ctx), cacheKey, session)
-}
-
-func nodesGeneratorStream(ctx context.Context, p commonVersionsListingParams, stream *data.ListSession) (<-chan *data.ExtendedNodeVersion, <-chan error) {
-	nodeCh := make(chan *data.ExtendedNodeVersion, 1000)
-	errCh := make(chan error, 1)
-	existed := stream.NamesMap
-
-	if len(stream.Next) != 0 {
-		existed[continuationToken] = struct{}{}
-	}
-
-	limit := p.MaxKeys
-	if len(stream.Next) == 0 {
-		limit++
-	}
-
-	go func() {
-		var generated int
-		var err error
-
-	LOOP:
-		for err == nil {
-			node, err := stream.Stream.Next(ctx)
-			if err != nil {
-				if !errors.Is(err, io.EOF) {
-					errCh <- fmt.Errorf("stream next: %w", err)
-				}
-				break LOOP
-			}
-
-			nodeExt := &data.ExtendedNodeVersion{
-				NodeVersion: node,
-				IsLatest:    true,
-				DirName:     tryDirectoryName(node, p.Prefix, p.Delimiter),
-			}
-
-			if shouldSkip(nodeExt, p, existed) {
-				continue
-			}
-
-			select {
-			case <-ctx.Done():
-				break LOOP
-			case nodeCh <- nodeExt:
-				generated++
-
-				if generated == limit { // we use maxKeys+1 to be able to know nextMarker/nextContinuationToken
-					break LOOP
-				}
-			}
-		}
-		close(nodeCh)
-		close(errCh)
-	}()
-
-	return nodeCh, errCh
-}
-
-func nodesGeneratorVersions(ctx context.Context, p commonVersionsListingParams, stream *data.ListSession) (<-chan *data.ExtendedNodeVersion, <-chan error) {
-	nodeCh := make(chan *data.ExtendedNodeVersion, 1000)
-	errCh := make(chan error, 1)
-	existed := stream.NamesMap
-
-	delete(existed, continuationToken)
-
-	go func() {
-		var (
-			generated int
-			ind       int
-			err       error
-			lastName  string
-			node      *data.NodeVersion
-			nodeExt   *data.ExtendedNodeVersion
-		)
-
-	LOOP:
-		for err == nil {
-			if ind < len(stream.Next) {
-				nodeExt = stream.Next[ind]
-				ind++
-			} else {
-				node, err = stream.Stream.Next(ctx)
-				if err != nil {
-					if !errors.Is(err, io.EOF) {
-						errCh <- fmt.Errorf("stream next: %w", err)
-					}
-					break LOOP
-				}
-
-				nodeExt = &data.ExtendedNodeVersion{
-					NodeVersion: node,
-					DirName:     tryDirectoryName(node, p.Prefix, p.Delimiter),
-				}
-			}
-
-			if shouldSkipVersions(nodeExt, p, existed) {
-				continue
-			}
-
-			select {
-			case <-ctx.Done():
-				break LOOP
-			case nodeCh <- nodeExt:
-				generated++
-				if generated > p.MaxKeys && nodeExt.NodeVersion.FilePath != lastName {
-					break LOOP
-				}
-				lastName = nodeExt.NodeVersion.FilePath
-			}
-		}
-		close(nodeCh)
-		close(errCh)
-	}()
-
-	return nodeCh, errCh
-}
-
-func (n *layer) initWorkerPool(ctx context.Context, size int, p commonVersionsListingParams, input <-chan *data.ExtendedNodeVersion) (<-chan *data.ExtendedNodeVersion, error) {
-	reqLog := n.reqLogger(ctx)
-	pool, err := ants.NewPool(size, ants.WithLogger(&logWrapper{reqLog}))
-	if err != nil {
-		return nil, fmt.Errorf("coudln't init go pool for listing: %w", err)
-	}
-	objCh := make(chan *data.ExtendedNodeVersion, size)
-
-	go func() {
-		var wg sync.WaitGroup
-
-	LOOP:
-		for node := range input {
-			select {
-			case <-ctx.Done():
-				break LOOP
-			default:
-			}
-
-			if node.DirName != "" || node.NodeVersion.IsFilledExtra() {
-				select {
-				case <-ctx.Done():
-				case objCh <- node:
-				}
-			} else {
-				// We have to make a copy of pointer to data.NodeVersion
-				// to get correct value in submitted task function.
-				func(node *data.ExtendedNodeVersion) {
-					wg.Add(1)
-					err = pool.Submit(func() {
-						defer wg.Done()
-
-						oi := n.objectInfoFromObjectsCacheOrFrostFS(ctx, p.BktInfo, node.NodeVersion)
-						if oi == nil {
-							// try to get object again
-							if oi = n.objectInfoFromObjectsCacheOrFrostFS(ctx, p.BktInfo, node.NodeVersion); oi == nil {
-								// do not process object which are definitely missing in object service
-								return
-							}
-						}
-
-						realSize, err := GetObjectSize(oi)
-						if err != nil {
-							reqLog.Debug(logs.FailedToGetRealObjectSize, zap.Error(err))
-							realSize = oi.Size
-						}
-
-						node.NodeVersion.FillExtra(&oi.Owner, &oi.Created, realSize)
-
-						select {
-						case <-ctx.Done():
-						case objCh <- node:
-						}
-					})
-					if err != nil {
-						wg.Done()
-						reqLog.Warn(logs.FailedToSubmitTaskToPool, zap.Error(err))
-					}
-				}(node)
-			}
-		}
-		wg.Wait()
-		close(objCh)
-		pool.Release()
-	}()
-
-	return objCh, nil
-}
-
-func shouldSkip(node *data.ExtendedNodeVersion, p commonVersionsListingParams, existed map[string]struct{}) bool {
-	if node.NodeVersion.IsDeleteMarker {
-		return true
-	}
-
-	filePath := node.NodeVersion.FilePath
-	if node.DirName != "" {
-		filePath = node.DirName
-	}
-
-	if _, ok := existed[filePath]; ok {
-		return true
-	}
-
-	if filePath <= p.Marker {
-		return true
-	}
-
-	if p.Bookmark != "" {
-		if _, ok := existed[continuationToken]; !ok {
-			if p.Bookmark != node.NodeVersion.OID.EncodeToString() {
-				return true
-			}
-			existed[continuationToken] = struct{}{}
-		}
-	}
-
-	existed[filePath] = struct{}{}
-	return false
-}
-
-func shouldSkipVersions(node *data.ExtendedNodeVersion, p commonVersionsListingParams, existed map[string]struct{}) bool {
-	filePath := node.NodeVersion.FilePath
-	if node.DirName != "" {
-		filePath = node.DirName
-		if _, ok := existed[filePath]; ok {
-			return true
-		}
-	}
-
-	if filePath < p.Marker {
-		return true
-	}
-
-	if p.Bookmark != "" {
-		if _, ok := existed[continuationToken]; !ok {
-			if p.Bookmark != node.NodeVersion.OID.EncodeToString() {
-				return true
-			}
-			existed[continuationToken] = struct{}{}
-			return true
-		}
-	}
-
-	existed[filePath] = struct{}{}
-	return false
-}
-
-func triageExtendedObjects(allObjects []*data.ExtendedNodeVersion) (prefixes []string, objects []*data.ExtendedNodeVersion) {
-	for _, ov := range allObjects {
-		if ov.DirName != "" {
-			prefixes = append(prefixes, ov.DirName)
-		} else {
-			objects = append(objects, ov)
-		}
-	}
-
-	return
-}
-
-func (n *layer) objectInfoFromObjectsCacheOrFrostFS(ctx context.Context, bktInfo *data.BucketInfo, node *data.NodeVersion) (oi *data.ObjectInfo) {
-	owner := n.BearerOwner(ctx)
-	if extInfo := n.cache.GetObject(owner, newAddress(bktInfo.CID, node.OID)); extInfo != nil {
-		return extInfo.ObjectInfo
-	}
-
-	meta, err := n.objectHead(ctx, bktInfo, node.OID)
-	if err != nil {
-		n.reqLogger(ctx).Warn(logs.CouldNotFetchObjectMeta, zap.Error(err))
-		return nil
-	}
-
-	oi = objectInfoFromMeta(bktInfo, meta)
-	oi.MD5Sum = node.MD5
-	n.cache.PutObject(owner, &data.ExtendedObjectInfo{ObjectInfo: oi, NodeVersion: node})
-
-	return oi
-}
-
-// tryDirectoryName forms directory name by prefix and delimiter.
-// If node isn't a directory empty string is returned.
-// This function doesn't check if node has a prefix. It must do a caller.
-func tryDirectoryName(node *data.NodeVersion, prefix, delimiter string) string {
-	if len(delimiter) == 0 {
-		return ""
-	}
-
-	tail := strings.TrimPrefix(node.FilePath, prefix)
-	index := strings.Index(tail, delimiter)
-	if index >= 0 {
-		return prefix + tail[:index+1]
-	}
-
-	return ""
-}
-
-func filterVersionsByMarker(objects []*data.ExtendedNodeVersion, p *ListObjectVersionsParams) ([]*data.ExtendedNodeVersion, error) {
-	if p.KeyMarker == "" {
-		return objects, nil
-	}
-
-	for i, obj := range objects {
-		if obj.NodeVersion.FilePath == p.KeyMarker {
-			for j := i; j < len(objects); j++ {
-				if objects[j].NodeVersion.FilePath != obj.NodeVersion.FilePath {
-					if p.VersionIDMarker == "" {
-						return objects[j:], nil
-					}
-					break
-				}
-				if objects[j].NodeVersion.OID.EncodeToString() == p.VersionIDMarker {
-					return objects[j+1:], nil
-				}
-			}
-			return nil, s3errors.GetAPIError(s3errors.ErrInvalidVersion)
-		} else if obj.NodeVersion.FilePath > p.KeyMarker {
-			if p.VersionIDMarker != "" {
-				return nil, s3errors.GetAPIError(s3errors.ErrInvalidVersion)
-			}
-			return objects[i:], nil
-		}
-	}
-
-	// don't use nil as empty slice to be consistent with `return objects[j+1:], nil` above
-	// that can be empty
-	return []*data.ExtendedNodeVersion{}, nil
-}
-
-func triageVersions(objVersions []*data.ExtendedNodeVersion) ([]*data.ExtendedNodeVersion, []*data.ExtendedNodeVersion) {
-	if len(objVersions) == 0 {
-		return nil, nil
-	}
-
-	var resVersion []*data.ExtendedNodeVersion
-	var resDelMarkVersions []*data.ExtendedNodeVersion
-
-	for _, version := range objVersions {
-		if version.NodeVersion.IsDeleteMarker {
-			resDelMarkVersions = append(resDelMarkVersions, version)
-		} else {
-			resVersion = append(resVersion, version)
-		}
-	}
-
-	return resVersion, resDelMarkVersions
-}

api/layer/multipart_upload.go

@@ -15,7 +15,6 @@ import (
 	"strings"
 	"time"
 
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/auth"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
 	s3errors "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/layer/encryption"
@@ -67,12 +66,11 @@ type (
 	}
 
 	UploadPartParams struct {
-		Info              *UploadInfoParams
-		PartNumber        int
-		Size              uint64
-		Reader            io.Reader
-		ContentMD5        string
-		ContentSHA256Hash string
+		Info       *UploadInfoParams
+		PartNumber int
+		Size       uint64
+		Reader     io.Reader
+		ContentMD5 string
 	}
 
 	UploadCopyParams struct {
@@ -262,20 +260,6 @@ func (n *layer) uploadPart(ctx context.Context, multipartInfo *data.MultipartInf
 		size = decSize
 	}
 
-	if !p.Info.Encryption.Enabled() && len(p.ContentSHA256Hash) > 0 && !auth.IsStandardContentSHA256(p.ContentSHA256Hash) {
-		contentHashBytes, err := hex.DecodeString(p.ContentSHA256Hash)
-		if err != nil {
-			return nil, s3errors.GetAPIError(s3errors.ErrContentSHA256Mismatch)
-		}
-		if !bytes.Equal(contentHashBytes, hash) {
-			err = n.objectDelete(ctx, bktInfo, id)
-			if err != nil {
-				n.reqLogger(ctx).Debug(logs.FailedToDeleteObject, zap.Stringer("cid", bktInfo.CID), zap.Stringer("oid", id))
-			}
-			return nil, s3errors.GetAPIError(s3errors.ErrContentSHA256Mismatch)
-		}
-	}
-
 	n.reqLogger(ctx).Debug(logs.UploadPart,
 		zap.String("multipart upload", p.Info.UploadID), zap.Int("part number", p.PartNumber),
 		zap.Stringer("cid", bktInfo.CID), zap.Stringer("oid", id))
@@ -392,7 +376,7 @@ func (n *layer) CompleteMultipartUpload(ctx context.Context, p *CompleteMultipar
 	md5Hash := md5.New()
 	for i, part := range p.Parts {
 		partInfo := partsInfo[part.PartNumber]
-		if partInfo == nil || data.UnQuote(part.ETag) != partInfo.GetETag(n.features.MD5Enabled()) {
+		if partInfo == nil || (part.ETag != partInfo.ETag && part.ETag != partInfo.MD5) {
 			return nil, nil, fmt.Errorf("%w: unknown part %d or etag mismatched", s3errors.GetAPIError(s3errors.ErrInvalidPart), part.PartNumber)
 		}
 		delete(partsInfo, part.PartNumber)
@@ -489,7 +473,7 @@ func (n *layer) CompleteMultipartUpload(ctx context.Context, p *CompleteMultipar
 		n.cache.DeleteObject(addr)
 	}
 
-	return uploadData, extObjInfo, n.treeService.DeleteMultipartUpload(ctx, p.Info.Bkt, multipartInfo)
+	return uploadData, extObjInfo, n.treeService.DeleteMultipartUpload(ctx, p.Info.Bkt, multipartInfo.ID)
 }
 
 func (n *layer) ListMultipartUploads(ctx context.Context, p *ListMultipartUploadsParams) (*ListMultipartUploadsInfo, error) {
@@ -565,7 +549,7 @@ func (n *layer) AbortMultipartUpload(ctx context.Context, p *UploadInfoParams) e
 		}
 	}
 
-	return n.treeService.DeleteMultipartUpload(ctx, p.Bkt, multipartInfo)
+	return n.treeService.DeleteMultipartUpload(ctx, p.Bkt, multipartInfo.ID)
 }
 
 func (n *layer) ListParts(ctx context.Context, p *ListPartsParams) (*ListPartsInfo, error) {
@@ -587,7 +571,7 @@ func (n *layer) ListParts(ctx context.Context, p *ListPartsParams) (*ListPartsIn
 
 	for _, partInfo := range partsInfo {
 		parts = append(parts, &Part{
-			ETag:         data.Quote(partInfo.GetETag(n.features.MD5Enabled())),
+			ETag:         partInfo.ETag,
 			LastModified: partInfo.Created.UTC().Format(time.RFC3339),
 			PartNumber:   partInfo.Number,
 			Size:         partInfo.Size,

api/layer/object.go

@@ -13,11 +13,13 @@ import (
 	"io"
 	"mime"
 	"path/filepath"
+	"sort"
 	"strconv"
 	"strings"
+	"sync"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/auth"
+	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/cache"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
 	apiErrors "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
@@ -26,6 +28,7 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"github.com/minio/sio"
+	"github.com/panjf2000/ants/v2"
 	"go.uber.org/zap"
 )
 
@@ -46,6 +49,38 @@ type (
 		bktInfo *data.BucketInfo
 	}
 
+	// ListObjectsParamsCommon contains common parameters for ListObjectsV1 and ListObjectsV2.
+	ListObjectsParamsCommon struct {
+		BktInfo   *data.BucketInfo
+		Delimiter string
+		Encode    string
+		MaxKeys   int
+		Prefix    string
+	}
+
+	// ListObjectsParamsV1 contains params for ListObjectsV1.
+	ListObjectsParamsV1 struct {
+		ListObjectsParamsCommon
+		Marker string
+	}
+
+	// ListObjectsParamsV2 contains params for ListObjectsV2.
+	ListObjectsParamsV2 struct {
+		ListObjectsParamsCommon
+		ContinuationToken string
+		StartAfter        string
+		FetchOwner        bool
+	}
+
+	allObjectParams struct {
+		Bucket            *data.BucketInfo
+		Delimiter         string
+		Prefix            string
+		MaxKeys           int
+		Marker            string
+		ContinuationToken string
+	}
+
 	DeleteMarkerError struct {
 		ErrorCode apiErrors.ErrorCode
 	}
@@ -281,30 +316,14 @@ func (n *layer) PutObject(ctx context.Context, p *PutObjectParams) (*data.Extend
 		}
 	}
 
-	if !p.Encryption.Enabled() && len(p.ContentSHA256Hash) > 0 && !auth.IsStandardContentSHA256(p.ContentSHA256Hash) {
-		contentHashBytes, err := hex.DecodeString(p.ContentSHA256Hash)
-		if err != nil {
-			return nil, apiErrors.GetAPIError(apiErrors.ErrContentSHA256Mismatch)
-		}
-		if !bytes.Equal(contentHashBytes, hash) {
-			err = n.objectDelete(ctx, p.BktInfo, id)
-			if err != nil {
-				n.reqLogger(ctx).Debug(logs.FailedToDeleteObject, zap.Stringer("cid", p.BktInfo.CID), zap.Stringer("oid", id))
-			}
-			return nil, apiErrors.GetAPIError(apiErrors.ErrContentSHA256Mismatch)
-		}
-	}
-
 	n.reqLogger(ctx).Debug(logs.PutObject, zap.Stringer("cid", p.BktInfo.CID), zap.Stringer("oid", id))
-	now := TimeNow(ctx)
+
 	newVersion := &data.NodeVersion{
 		BaseNodeVersion: data.BaseNodeVersion{
 			OID:      id,
 			ETag:     hex.EncodeToString(hash),
 			FilePath: p.Object,
-			Size:     p.Size,
-			Created:  &now,
-			Owner:    &n.gateOwner,
+			Size:     size,
 		},
 		IsUnversioned: !bktSettings.VersioningEnabled(),
 		IsCombined:    p.Header[MultipartObjectSize] != "",
@@ -377,7 +396,7 @@ func (n *layer) headLastVersionIfNotDeleted(ctx context.Context, bkt *data.Bucke
 		return nil, err
 	}
 
-	if node.IsDeleteMarker {
+	if node.IsDeleteMarker() {
 		return nil, DeleteMarkerError{ErrorCode: apiErrors.ErrNoSuchKey}
 	}
 
@@ -434,7 +453,7 @@ func (n *layer) headVersion(ctx context.Context, bkt *data.BucketInfo, p *HeadOb
 		return extObjInfo, nil
 	}
 
-	if foundVersion.IsDeleteMarker {
+	if foundVersion.IsDeleteMarker() {
 		return nil, DeleteMarkerError{ErrorCode: apiErrors.ErrMethodNotAllowed}
 	}
 
@@ -498,6 +517,61 @@ func (n *layer) objectPutAndHash(ctx context.Context, prm PrmObjectCreate, bktIn
 	return size, id, hash.Sum(nil), md5Hash.Sum(nil), nil
 }
 
+// ListObjectsV1 returns objects in a bucket for requests of Version 1.
+func (n *layer) ListObjectsV1(ctx context.Context, p *ListObjectsParamsV1) (*ListObjectsInfoV1, error) {
+	var result ListObjectsInfoV1
+
+	prm := allObjectParams{
+		Bucket:    p.BktInfo,
+		Delimiter: p.Delimiter,
+		Prefix:    p.Prefix,
+		MaxKeys:   p.MaxKeys,
+		Marker:    p.Marker,
+	}
+
+	objects, next, err := n.getLatestObjectsVersions(ctx, prm)
+	if err != nil {
+		return nil, err
+	}
+
+	if next != nil {
+		result.IsTruncated = true
+		result.NextMarker = objects[len(objects)-1].Name
+	}
+
+	result.Prefixes, result.Objects = triageObjects(objects)
+
+	return &result, nil
+}
+
+// ListObjectsV2 returns objects in a bucket for requests of Version 2.
+func (n *layer) ListObjectsV2(ctx context.Context, p *ListObjectsParamsV2) (*ListObjectsInfoV2, error) {
+	var result ListObjectsInfoV2
+
+	prm := allObjectParams{
+		Bucket:            p.BktInfo,
+		Delimiter:         p.Delimiter,
+		Prefix:            p.Prefix,
+		MaxKeys:           p.MaxKeys,
+		Marker:            p.StartAfter,
+		ContinuationToken: p.ContinuationToken,
+	}
+
+	objects, next, err := n.getLatestObjectsVersions(ctx, prm)
+	if err != nil {
+		return nil, err
+	}
+
+	if next != nil {
+		result.IsTruncated = true
+		result.NextContinuationToken = next.ID.EncodeToString()
+	}
+
+	result.Prefixes, result.Objects = triageObjects(objects)
+
+	return &result, nil
+}
+
 type logWrapper struct {
 	log *zap.Logger
 }
@@ -506,11 +580,310 @@ func (l *logWrapper) Printf(format string, args ...interface{}) {
 	l.log.Info(fmt.Sprintf(format, args...))
 }
 
+func (n *layer) getLatestObjectsVersions(ctx context.Context, p allObjectParams) (objects []*data.ObjectInfo, next *data.ObjectInfo, err error) {
+	if p.MaxKeys == 0 {
+		return nil, nil, nil
+	}
+
+	owner := n.BearerOwner(ctx)
+	cacheKey := cache.CreateObjectsListCacheKey(p.Bucket.CID, p.Prefix, true)
+	nodeVersions := n.cache.GetList(owner, cacheKey)
+
+	if nodeVersions == nil {
+		nodeVersions, err = n.treeService.GetLatestVersionsByPrefix(ctx, p.Bucket, p.Prefix)
+		if err != nil {
+			return nil, nil, err
+		}
+		n.cache.PutList(owner, cacheKey, nodeVersions)
+	}
+
+	if len(nodeVersions) == 0 {
+		return nil, nil, nil
+	}
+
+	sort.Slice(nodeVersions, func(i, j int) bool {
+		return nodeVersions[i].FilePath < nodeVersions[j].FilePath
+	})
+
+	poolCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	objOutCh, err := n.initWorkerPool(poolCtx, 2, p, nodesGenerator(poolCtx, p, nodeVersions))
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to init worker pool: %w", err)
+	}
+
+	objects = make([]*data.ObjectInfo, 0, p.MaxKeys)
+
+	for obj := range objOutCh {
+		objects = append(objects, obj)
+	}
+
+	sort.Slice(objects, func(i, j int) bool {
+		return objects[i].Name < objects[j].Name
+	})
+
+	if len(objects) > p.MaxKeys {
+		next = objects[p.MaxKeys]
+		objects = objects[:p.MaxKeys]
+	}
+
+	return
+}
+
+func nodesGenerator(ctx context.Context, p allObjectParams, nodeVersions []*data.NodeVersion) <-chan *data.NodeVersion {
+	nodeCh := make(chan *data.NodeVersion)
+	existed := make(map[string]struct{}, len(nodeVersions)) // to squash the same directories
+
+	go func() {
+		var generated int
+	LOOP:
+		for _, node := range nodeVersions {
+			if shouldSkip(node, p, existed) {
+				continue
+			}
+
+			select {
+			case <-ctx.Done():
+				break LOOP
+			case nodeCh <- node:
+				generated++
+				if generated == p.MaxKeys+1 { // we use maxKeys+1 to be able to know nextMarker/nextContinuationToken
+					break LOOP
+				}
+			}
+		}
+		close(nodeCh)
+	}()
+
+	return nodeCh
+}
+
+func (n *layer) initWorkerPool(ctx context.Context, size int, p allObjectParams, input <-chan *data.NodeVersion) (<-chan *data.ObjectInfo, error) {
+	reqLog := n.reqLogger(ctx)
+	pool, err := ants.NewPool(size, ants.WithLogger(&logWrapper{reqLog}))
+	if err != nil {
+		return nil, fmt.Errorf("coudln't init go pool for listing: %w", err)
+	}
+	objCh := make(chan *data.ObjectInfo)
+
+	go func() {
+		var wg sync.WaitGroup
+
+	LOOP:
+		for node := range input {
+			select {
+			case <-ctx.Done():
+				break LOOP
+			default:
+			}
+
+			// We have to make a copy of pointer to data.NodeVersion
+			// to get correct value in submitted task function.
+			func(node *data.NodeVersion) {
+				wg.Add(1)
+				err = pool.Submit(func() {
+					defer wg.Done()
+					oi := n.objectInfoFromObjectsCacheOrFrostFS(ctx, p.Bucket, node, p.Prefix, p.Delimiter)
+					if oi == nil {
+						// try to get object again
+						if oi = n.objectInfoFromObjectsCacheOrFrostFS(ctx, p.Bucket, node, p.Prefix, p.Delimiter); oi == nil {
+							// do not process object which are definitely missing in object service
+							return
+						}
+					}
+					select {
+					case <-ctx.Done():
+					case objCh <- oi:
+					}
+				})
+				if err != nil {
+					wg.Done()
+					reqLog.Warn(logs.FailedToSubmitTaskToPool, zap.Error(err))
+				}
+			}(node)
+		}
+		wg.Wait()
+		close(objCh)
+		pool.Release()
+	}()
+
+	return objCh, nil
+}
+
+func (n *layer) bucketNodeVersions(ctx context.Context, bkt *data.BucketInfo, prefix string) ([]*data.NodeVersion, error) {
+	var err error
+
+	owner := n.BearerOwner(ctx)
+	cacheKey := cache.CreateObjectsListCacheKey(bkt.CID, prefix, false)
+	nodeVersions := n.cache.GetList(owner, cacheKey)
+
+	if nodeVersions == nil {
+		nodeVersions, err = n.treeService.GetAllVersionsByPrefix(ctx, bkt, prefix)
+		if err != nil {
+			return nil, fmt.Errorf("get all versions from tree service: %w", err)
+		}
+
+		n.cache.PutList(owner, cacheKey, nodeVersions)
+	}
+
+	return nodeVersions, nil
+}
+
+func (n *layer) getAllObjectsVersions(ctx context.Context, bkt *data.BucketInfo, prefix, delimiter string) (map[string][]*data.ExtendedObjectInfo, error) {
+	nodeVersions, err := n.bucketNodeVersions(ctx, bkt, prefix)
+	if err != nil {
+		return nil, err
+	}
+
+	versions := make(map[string][]*data.ExtendedObjectInfo, len(nodeVersions))
+
+	for _, nodeVersion := range nodeVersions {
+		oi := &data.ObjectInfo{}
+
+		if nodeVersion.IsDeleteMarker() { // delete marker does not match any object in FrostFS
+			oi.ID = nodeVersion.OID
+			oi.Name = nodeVersion.FilePath
+			oi.Owner = nodeVersion.DeleteMarker.Owner
+			oi.Created = nodeVersion.DeleteMarker.Created
+			oi.IsDeleteMarker = true
+		} else {
+			if oi = n.objectInfoFromObjectsCacheOrFrostFS(ctx, bkt, nodeVersion, prefix, delimiter); oi == nil {
+				continue
+			}
+		}
+
+		eoi := &data.ExtendedObjectInfo{
+			ObjectInfo:  oi,
+			NodeVersion: nodeVersion,
+		}
+
+		objVersions, ok := versions[oi.Name]
+		if !ok {
+			objVersions = []*data.ExtendedObjectInfo{eoi}
+		} else if !oi.IsDir {
+			objVersions = append(objVersions, eoi)
+		}
+		versions[oi.Name] = objVersions
+	}
+
+	return versions, nil
+}
+
 func IsSystemHeader(key string) bool {
 	_, ok := api.SystemMetadata[key]
 	return ok || strings.HasPrefix(key, api.FrostFSSystemMetadataPrefix)
 }
 
+func shouldSkip(node *data.NodeVersion, p allObjectParams, existed map[string]struct{}) bool {
+	if node.IsDeleteMarker() {
+		return true
+	}
+
+	filePath := node.FilePath
+	if dirName := tryDirectoryName(node, p.Prefix, p.Delimiter); len(dirName) != 0 {
+		filePath = dirName
+	}
+	if _, ok := existed[filePath]; ok {
+		return true
+	}
+
+	if filePath <= p.Marker {
+		return true
+	}
+
+	if p.ContinuationToken != "" {
+		if _, ok := existed[continuationToken]; !ok {
+			if p.ContinuationToken != node.OID.EncodeToString() {
+				return true
+			}
+			existed[continuationToken] = struct{}{}
+		}
+	}
+
+	existed[filePath] = struct{}{}
+	return false
+}
+
+func triageObjects(allObjects []*data.ObjectInfo) (prefixes []string, objects []*data.ObjectInfo) {
+	for _, ov := range allObjects {
+		if ov.IsDir {
+			prefixes = append(prefixes, ov.Name)
+		} else {
+			objects = append(objects, ov)
+		}
+	}
+
+	return
+}
+
+func triageExtendedObjects(allObjects []*data.ExtendedObjectInfo) (prefixes []string, objects []*data.ExtendedObjectInfo) {
+	for _, ov := range allObjects {
+		if ov.ObjectInfo.IsDir {
+			prefixes = append(prefixes, ov.ObjectInfo.Name)
+		} else {
+			objects = append(objects, ov)
+		}
+	}
+
+	return
+}
+
+func (n *layer) objectInfoFromObjectsCacheOrFrostFS(ctx context.Context, bktInfo *data.BucketInfo, node *data.NodeVersion, prefix, delimiter string) (oi *data.ObjectInfo) {
+	if oiDir := tryDirectory(bktInfo, node, prefix, delimiter); oiDir != nil {
+		return oiDir
+	}
+
+	owner := n.BearerOwner(ctx)
+	if extInfo := n.cache.GetObject(owner, newAddress(bktInfo.CID, node.OID)); extInfo != nil {
+		return extInfo.ObjectInfo
+	}
+
+	meta, err := n.objectHead(ctx, bktInfo, node.OID)
+	if err != nil {
+		n.reqLogger(ctx).Warn(logs.CouldNotFetchObjectMeta, zap.Error(err))
+		return nil
+	}
+
+	oi = objectInfoFromMeta(bktInfo, meta)
+	oi.MD5Sum = node.MD5
+	n.cache.PutObject(owner, &data.ExtendedObjectInfo{ObjectInfo: oi, NodeVersion: node})
+
+	return oi
+}
+
+func tryDirectory(bktInfo *data.BucketInfo, node *data.NodeVersion, prefix, delimiter string) *data.ObjectInfo {
+	dirName := tryDirectoryName(node, prefix, delimiter)
+	if len(dirName) == 0 {
+		return nil
+	}
+
+	return &data.ObjectInfo{
+		ID:             node.OID, // to use it as continuation token
+		CID:            bktInfo.CID,
+		IsDir:          true,
+		IsDeleteMarker: node.IsDeleteMarker(),
+		Bucket:         bktInfo.Name,
+		Name:           dirName,
+	}
+}
+
+// tryDirectoryName forms directory name by prefix and delimiter.
+// If node isn't a directory empty string is returned.
+// This function doesn't check if node has a prefix. It must do a caller.
+func tryDirectoryName(node *data.NodeVersion, prefix, delimiter string) string {
+	if len(delimiter) == 0 {
+		return ""
+	}
+
+	tail := strings.TrimPrefix(node.FilePath, prefix)
+	index := strings.Index(tail, delimiter)
+	if index >= 0 {
+		return prefix + tail[:index+1]
+	}
+
+	return ""
+}
+
 func wrapReader(input io.Reader, bufSize int, f func(buf []byte)) io.Reader {
 	if input == nil {
 		return nil

api/layer/tagging.go

@@ -174,13 +174,13 @@ func (n *layer) getNodeVersion(ctx context.Context, objVersion *ObjectVersion) (
 		}
 	}
 
-	if err == nil && version.IsDeleteMarker && !objVersion.NoErrorOnDeleteMarker {
+	if err == nil && version.IsDeleteMarker() && !objVersion.NoErrorOnDeleteMarker {
 		return nil, fmt.Errorf("%w: found version is delete marker", s3errors.GetAPIError(s3errors.ErrNoSuchKey))
 	} else if errors.Is(err, ErrNodeNotFound) {
 		return nil, fmt.Errorf("%w: %s", s3errors.GetAPIError(s3errors.ErrNoSuchKey), err.Error())
 	}
 
-	if err == nil && version != nil && !version.IsDeleteMarker {
+	if err == nil && version != nil && !version.IsDeleteMarker() {
 		n.reqLogger(ctx).Debug(logs.GetTreeNode,
 			zap.Stringer("cid", objVersion.BktInfo.CID), zap.Stringer("oid", version.OID))
 	}

api/layer/tree_mock.go

@@ -3,7 +3,6 @@ package layer
 import (
 	"context"
 	"fmt"
-	"io"
 	"sort"
 	"strings"
 
@@ -11,21 +10,6 @@ import (
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 )
 
-type VersionsByPrefixStreamMock struct {
-	result []*data.NodeVersion
-	offset int
-}
-
-func (s *VersionsByPrefixStreamMock) Next(context.Context) (*data.NodeVersion, error) {
-	if s.offset > len(s.result)-1 {
-		return nil, io.EOF
-	}
-
-	res := s.result[s.offset]
-	s.offset++
-	return res, nil
-}
-
 type TreeServiceMock struct {
 	settings   map[string]*data.BucketSettings
 	versions   map[string]map[string][]*data.NodeVersion
@@ -65,8 +49,14 @@ func (t *TreeServiceMock) PutObjectTagging(_ context.Context, bktInfo *data.Buck
 	return nil
 }
 
-func (t *TreeServiceMock) DeleteObjectTagging(ctx context.Context, bktInfo *data.BucketInfo, objVersion *data.NodeVersion) error {
-	return t.PutObjectTagging(ctx, bktInfo, objVersion, nil)
+func (t *TreeServiceMock) DeleteObjectTagging(_ context.Context, bktInfo *data.BucketInfo, objVersion *data.NodeVersion) error {
+	cnrTagsMap, ok := t.tags[bktInfo.CID.EncodeToString()]
+	if !ok {
+		return nil
+	}
+
+	delete(cnrTagsMap, objVersion.ID)
+	return nil
 }
 
 func (t *TreeServiceMock) GetBucketTagging(context.Context, *data.BucketInfo) (map[string]string, error) {
@@ -187,7 +177,7 @@ func (t *TreeServiceMock) GetLatestVersion(_ context.Context, bktInfo *data.Buck
 	return nil, ErrNodeNotFound
 }
 
-func (t *TreeServiceMock) InitVersionsByPrefixStream(_ context.Context, bktInfo *data.BucketInfo, prefix string, latestOnly bool) (data.VersionsStream, error) {
+func (t *TreeServiceMock) GetLatestVersionsByPrefix(_ context.Context, bktInfo *data.BucketInfo, prefix string) ([]*data.NodeVersion, error) {
 	cnrVersionsMap, ok := t.versions[bktInfo.CID.EncodeToString()]
 	if !ok {
 		return nil, ErrNodeNotFound
@@ -200,11 +190,6 @@ func (t *TreeServiceMock) InitVersionsByPrefixStream(_ context.Context, bktInfo
 			continue
 		}
 
-		if !latestOnly {
-			result = append(result, versions...)
-			continue
-		}
-
 		sort.Slice(versions, func(i, j int) bool {
 			return versions[i].ID < versions[j].ID
 		})
@@ -214,9 +199,7 @@ func (t *TreeServiceMock) InitVersionsByPrefixStream(_ context.Context, bktInfo
 		}
 	}
 
-	return &VersionsByPrefixStreamMock{
-		result: result,
-	}, nil
+	return result, nil
 }
 
 func (t *TreeServiceMock) GetUnversioned(_ context.Context, bktInfo *data.BucketInfo, objectName string) (*data.NodeVersion, error) {
@@ -400,7 +383,7 @@ LOOP:
 	return result, nil
 }
 
-func (t *TreeServiceMock) DeleteMultipartUpload(_ context.Context, bktInfo *data.BucketInfo, multipartInfo *data.MultipartInfo) error {
+func (t *TreeServiceMock) DeleteMultipartUpload(_ context.Context, bktInfo *data.BucketInfo, multipartNodeID uint64) error {
 	cnrMultipartsMap := t.multiparts[bktInfo.CID.EncodeToString()]
 
 	var uploadID string
@@ -408,7 +391,7 @@ func (t *TreeServiceMock) DeleteMultipartUpload(_ context.Context, bktInfo *data
 LOOP:
 	for key, multiparts := range cnrMultipartsMap {
 		for i, multipart := range multiparts {
-			if multipart.ID == multipartInfo.ID {
+			if multipart.ID == multipartNodeID {
 				uploadID = multipart.UploadID
 				cnrMultipartsMap[key] = append(multiparts[:i], multiparts[i+1:]...)
 				break LOOP

api/layer/tree_service.go

@@ -54,7 +54,8 @@ type TreeService interface {
 
 	GetVersions(ctx context.Context, bktInfo *data.BucketInfo, objectName string) ([]*data.NodeVersion, error)
 	GetLatestVersion(ctx context.Context, bktInfo *data.BucketInfo, objectName string) (*data.NodeVersion, error)
-	InitVersionsByPrefixStream(ctx context.Context, bktInfo *data.BucketInfo, prefix string, latestOnly bool) (data.VersionsStream, error)
+	GetLatestVersionsByPrefix(ctx context.Context, bktInfo *data.BucketInfo, prefix string) ([]*data.NodeVersion, error)
+	GetAllVersionsByPrefix(ctx context.Context, bktInfo *data.BucketInfo, prefix string) ([]*data.NodeVersion, error)
 	GetUnversioned(ctx context.Context, bktInfo *data.BucketInfo, objectName string) (*data.NodeVersion, error)
 	AddVersion(ctx context.Context, bktInfo *data.BucketInfo, newVersion *data.NodeVersion) (uint64, error)
 	RemoveVersion(ctx context.Context, bktInfo *data.BucketInfo, nodeID uint64) error
@@ -63,7 +64,7 @@ type TreeService interface {
 	GetLock(ctx context.Context, bktInfo *data.BucketInfo, nodeID uint64) (*data.LockInfo, error)
 
 	CreateMultipartUpload(ctx context.Context, bktInfo *data.BucketInfo, info *data.MultipartInfo) error
-	DeleteMultipartUpload(ctx context.Context, bktInfo *data.BucketInfo, info *data.MultipartInfo) error
+	DeleteMultipartUpload(ctx context.Context, bktInfo *data.BucketInfo, multipartNodeID uint64) error
 	GetMultipartUploadsByPrefix(ctx context.Context, bktInfo *data.BucketInfo, prefix string) ([]*data.MultipartInfo, error)
 	GetMultipartUpload(ctx context.Context, bktInfo *data.BucketInfo, objectName, uploadID string) (*data.MultipartInfo, error)
 

api/layer/util.go

@@ -13,6 +13,39 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 )
 
+type (
+	// ListObjectsInfo contains common fields of data for ListObjectsV1 and ListObjectsV2.
+	ListObjectsInfo struct {
+		Prefixes    []string
+		Objects     []*data.ObjectInfo
+		IsTruncated bool
+	}
+
+	// ListObjectsInfoV1 holds data which ListObjectsV1 returns.
+	ListObjectsInfoV1 struct {
+		ListObjectsInfo
+		NextMarker string
+	}
+
+	// ListObjectsInfoV2 holds data which ListObjectsV2 returns.
+	ListObjectsInfoV2 struct {
+		ListObjectsInfo
+		NextContinuationToken string
+	}
+
+	// ListObjectVersionsInfo stores info and list of objects versions.
+	ListObjectVersionsInfo struct {
+		CommonPrefixes      []string
+		IsTruncated         bool
+		KeyMarker           string
+		NextKeyMarker       string
+		NextVersionIDMarker string
+		Version             []*data.ExtendedObjectInfo
+		DeleteMarker        []*data.ExtendedObjectInfo
+		VersionIDMarker     string
+	}
+)
+
 // PathSeparator is a path components separator string.
 const PathSeparator = string(os.PathSeparator)
 
@@ -48,8 +81,9 @@ func objectInfoFromMeta(bkt *data.BucketInfo, meta *object.Object) *data.ObjectI
 	objID, _ := meta.ID()
 	payloadChecksum, _ := meta.PayloadChecksum()
 	return &data.ObjectInfo{
-		ID:  objID,
-		CID: bkt.CID,
+		ID:    objID,
+		CID:   bkt.CID,
+		IsDir: false,
 
 		Bucket:        bkt.Name,
 		Name:          filepathFromObject(meta),

api/layer/util_test.go

@@ -1,13 +1,51 @@
 package layer
 
 import (
+	"encoding/hex"
+	"net/http"
 	"testing"
+	"time"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/checksum"
+	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
 	"github.com/stretchr/testify/require"
 )
 
+var (
+	defaultTestCreated       = time.Now()
+	defaultTestPayload       = []byte("test object payload")
+	defaultTestPayloadLength = uint64(len(defaultTestPayload))
+	defaultTestContentType   = http.DetectContentType(defaultTestPayload)
+)
+
+func newTestInfo(obj oid.ID, bkt *data.BucketInfo, name string, isDir bool) *data.ObjectInfo {
+	var hashSum checksum.Checksum
+	info := &data.ObjectInfo{
+		ID:          obj,
+		Name:        name,
+		Bucket:      bkt.Name,
+		CID:         bkt.CID,
+		Size:        defaultTestPayloadLength,
+		ContentType: defaultTestContentType,
+		Created:     time.Unix(defaultTestCreated.Unix(), 0),
+		Owner:       bkt.Owner,
+		Headers:     make(map[string]string),
+		HashSum:     hex.EncodeToString(hashSum.Value()),
+	}
+
+	if isDir {
+		info.IsDir = true
+		info.Size = 0
+		info.ContentType = ""
+		info.Headers = nil
+	}
+
+	return info
+}
+
 func newTestNodeVersion(id oid.ID, name string) *data.NodeVersion {
 	return &data.NodeVersion{
 		BaseNodeVersion: data.BaseNodeVersion{
@@ -18,84 +56,98 @@ func newTestNodeVersion(id oid.ID, name string) *data.NodeVersion {
 }
 
 func TestTryDirectory(t *testing.T) {
+	var uid user.ID
 	var id oid.ID
+	var containerID cid.ID
+
+	bkt := &data.BucketInfo{
+		Name:    "test-container",
+		CID:     containerID,
+		Owner:   uid,
+		Created: time.Now(),
+	}
 
 	cases := []struct {
 		name      string
 		prefix    string
-		result    string
+		result    *data.ObjectInfo
 		node      *data.NodeVersion
 		delimiter string
 	}{
 		{
 			name:   "small.jpg",
-			result: "",
+			result: nil,
 			node:   newTestNodeVersion(id, "small.jpg"),
 		},
 		{
 			name:   "small.jpg not matched prefix",
 			prefix: "big",
-			result: "",
+			result: nil,
 			node:   newTestNodeVersion(id, "small.jpg"),
 		},
 		{
 			name:      "small.jpg delimiter",
 			delimiter: "/",
-			result:    "",
+			result:    nil,
 			node:      newTestNodeVersion(id, "small.jpg"),
 		},
 		{
 			name:   "test/small.jpg",
-			result: "",
+			result: nil,
 			node:   newTestNodeVersion(id, "test/small.jpg"),
 		},
 		{
 			name:      "test/small.jpg with prefix and delimiter",
 			prefix:    "test/",
 			delimiter: "/",
-			result:    "",
+			result:    nil,
 			node:      newTestNodeVersion(id, "test/small.jpg"),
 		},
 		{
 			name:   "a/b/small.jpg",
 			prefix: "a",
-			result: "",
+			result: nil,
 			node:   newTestNodeVersion(id, "a/b/small.jpg"),
 		},
 		{
 			name:      "a/b/small.jpg",
 			prefix:    "a/",
 			delimiter: "/",
-			result:    "a/b/",
+			result:    newTestInfo(id, bkt, "a/b/", true),
 			node:      newTestNodeVersion(id, "a/b/small.jpg"),
 		},
 		{
 			name:      "a/b/c/small.jpg",
 			prefix:    "a/",
 			delimiter: "/",
-			result:    "a/b/",
+			result:    newTestInfo(id, bkt, "a/b/", true),
 			node:      newTestNodeVersion(id, "a/b/c/small.jpg"),
 		},
 		{
 			name:      "a/b/c/small.jpg",
 			prefix:    "a/b/c/s",
 			delimiter: "/",
-			result:    "",
+			result:    nil,
 			node:      newTestNodeVersion(id, "a/b/c/small.jpg"),
 		},
 		{
 			name:      "a/b/c/big.jpg",
 			prefix:    "a/b/",
 			delimiter: "/",
-			result:    "a/b/c/",
+			result:    newTestInfo(id, bkt, "a/b/c/", true),
 			node:      newTestNodeVersion(id, "a/b/c/big.jpg"),
 		},
 	}
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			dirName := tryDirectoryName(tc.node, tc.prefix, tc.delimiter)
-			require.Equal(t, tc.result, dirName)
+			info := tryDirectory(bkt, tc.node, tc.prefix, tc.delimiter)
+			if tc.result != nil {
+				tc.result.Created = time.Time{}
+				tc.result.Owner = user.ID{}
+			}
+
+			require.Equal(t, tc.result, info)
 		})
 	}
 }

api/layer/versioning.go

@@ -0,0 +1,109 @@
+package layer
+
+import (
+	"context"
+	"sort"
+
+	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
+	s3errors "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
+)
+
+func (n *layer) ListObjectVersions(ctx context.Context, p *ListObjectVersionsParams) (*ListObjectVersionsInfo, error) {
+	var (
+		allObjects = make([]*data.ExtendedObjectInfo, 0, p.MaxKeys)
+		res        = &ListObjectVersionsInfo{}
+	)
+
+	versions, err := n.getAllObjectsVersions(ctx, p.BktInfo, p.Prefix, p.Delimiter)
+	if err != nil {
+		return nil, err
+	}
+
+	sortedNames := make([]string, 0, len(versions))
+	for k := range versions {
+		sortedNames = append(sortedNames, k)
+	}
+	sort.Strings(sortedNames)
+
+	for _, name := range sortedNames {
+		sortedVersions := versions[name]
+		sort.Slice(sortedVersions, func(i, j int) bool {
+			return sortedVersions[j].NodeVersion.Timestamp < sortedVersions[i].NodeVersion.Timestamp // sort in reverse order
+		})
+
+		for i, version := range sortedVersions {
+			version.IsLatest = i == 0
+			allObjects = append(allObjects, version)
+		}
+	}
+
+	if allObjects, err = filterVersionsByMarker(allObjects, p); err != nil {
+		return nil, err
+	}
+
+	res.CommonPrefixes, allObjects = triageExtendedObjects(allObjects)
+
+	if len(allObjects) > p.MaxKeys {
+		res.IsTruncated = true
+		res.NextKeyMarker = allObjects[p.MaxKeys-1].ObjectInfo.Name
+		res.NextVersionIDMarker = allObjects[p.MaxKeys-1].ObjectInfo.VersionID()
+
+		allObjects = allObjects[:p.MaxKeys]
+		res.KeyMarker = p.KeyMarker
+		res.VersionIDMarker = p.VersionIDMarker
+	}
+
+	res.Version, res.DeleteMarker = triageVersions(allObjects)
+	return res, nil
+}
+
+func filterVersionsByMarker(objects []*data.ExtendedObjectInfo, p *ListObjectVersionsParams) ([]*data.ExtendedObjectInfo, error) {
+	if p.KeyMarker == "" {
+		return objects, nil
+	}
+
+	for i, obj := range objects {
+		if obj.ObjectInfo.Name == p.KeyMarker {
+			for j := i; j < len(objects); j++ {
+				if objects[j].ObjectInfo.Name != obj.ObjectInfo.Name {
+					if p.VersionIDMarker == "" {
+						return objects[j:], nil
+					}
+					break
+				}
+				if objects[j].ObjectInfo.VersionID() == p.VersionIDMarker {
+					return objects[j+1:], nil
+				}
+			}
+			return nil, s3errors.GetAPIError(s3errors.ErrInvalidVersion)
+		} else if obj.ObjectInfo.Name > p.KeyMarker {
+			if p.VersionIDMarker != "" {
+				return nil, s3errors.GetAPIError(s3errors.ErrInvalidVersion)
+			}
+			return objects[i:], nil
+		}
+	}
+
+	// don't use nil as empty slice to be consistent with `return objects[j+1:], nil` above
+	// that can be empty
+	return []*data.ExtendedObjectInfo{}, nil
+}
+
+func triageVersions(objVersions []*data.ExtendedObjectInfo) ([]*data.ExtendedObjectInfo, []*data.ExtendedObjectInfo) {
+	if len(objVersions) == 0 {
+		return nil, nil
+	}
+
+	var resVersion []*data.ExtendedObjectInfo
+	var resDelMarkVersions []*data.ExtendedObjectInfo
+
+	for _, version := range objVersions {
+		if version.NodeVersion.IsDeleteMarker() {
+			resDelMarkVersions = append(resDelMarkVersions, version)
+		} else {
+			resVersion = append(resVersion, version)
+		}
+	}
+
+	return resVersion, resDelMarkVersions
+}

api/layer/versioning_test.go

@@ -72,7 +72,7 @@ func (tc *testContext) deleteObject(objectName, versionID string, settings *data
 	}
 }
 
-func (tc *testContext) listObjectsV1() []*data.ExtendedNodeVersion {
+func (tc *testContext) listObjectsV1() []*data.ObjectInfo {
 	res, err := tc.layer.ListObjectsV1(tc.ctx, &ListObjectsParamsV1{
 		ListObjectsParamsCommon: ListObjectsParamsCommon{
 			BktInfo: tc.bktInfo,
@@ -83,7 +83,7 @@ func (tc *testContext) listObjectsV1() []*data.ExtendedNodeVersion {
 	return res.Objects
 }
 
-func (tc *testContext) listObjectsV2() []*data.ExtendedNodeVersion {
+func (tc *testContext) listObjectsV2() []*data.ObjectInfo {
 	res, err := tc.layer.ListObjectsV2(tc.ctx, &ListObjectsParamsV2{
 		ListObjectsParamsCommon: ListObjectsParamsCommon{
 			BktInfo: tc.bktInfo,
@@ -168,11 +168,10 @@ func prepareContext(t *testing.T, cachesConfig ...*CachesConfig) *testContext {
 	user.IDFromKey(&owner, key.PrivateKey.PublicKey)
 
 	layerCfg := &Config{
-		Cache:       NewCache(config),
+		Caches:      config,
 		AnonKey:     AnonymousKey{Key: key},
 		TreeService: NewTreeService(),
 		Features:    &FeatureSettingsMock{},
-		GateOwner:   owner,
 	}
 
 	return &testContext{
@@ -289,10 +288,9 @@ func TestVersioningDeleteSpecificObjectVersion(t *testing.T) {
 	tc.getObject(tc.obj, "", true)
 
 	versions := tc.listVersions()
-	require.Len(t, versions.DeleteMarker, 1)
 	for _, ver := range versions.DeleteMarker {
 		if ver.IsLatest {
-			tc.deleteObject(tc.obj, ver.NodeVersion.OID.EncodeToString(), settings)
+			tc.deleteObject(tc.obj, ver.ObjectInfo.VersionID(), settings)
 		}
 	}
 
@@ -324,112 +322,112 @@ func TestFilterVersionsByMarker(t *testing.T) {
 
 	for _, tc := range []struct {
 		name     string
-		objects  []*data.ExtendedNodeVersion
+		objects  []*data.ExtendedObjectInfo
 		params   *ListObjectVersionsParams
-		expected []*data.ExtendedNodeVersion
+		expected []*data.ExtendedObjectInfo
 		error    bool
 	}{
 		{
 			name: "missed key marker",
-			objects: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[0]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[1]}}},
+			objects: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[0]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[1]}},
 			},
 			params: &ListObjectVersionsParams{KeyMarker: "", VersionIDMarker: "dummy"},
-			expected: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[0]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[1]}}},
+			expected: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[0]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[1]}},
 			},
 		},
 		{
 			name: "last version id",
-			objects: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[0]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[1]}}},
+			objects: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[0]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[1]}},
 			},
 			params:   &ListObjectVersionsParams{KeyMarker: "obj0", VersionIDMarker: testOIDs[1].EncodeToString()},
-			expected: []*data.ExtendedNodeVersion{},
+			expected: []*data.ExtendedObjectInfo{},
 		},
 		{
 			name: "same name, different versions",
-			objects: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[0]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[1]}}},
+			objects: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[0]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[1]}},
 			},
 			params: &ListObjectVersionsParams{KeyMarker: "obj0", VersionIDMarker: testOIDs[0].EncodeToString()},
-			expected: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[1]}}},
+			expected: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[1]}},
 			},
 		},
 		{
 			name: "different name, different versions",
-			objects: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[0]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj1", OID: testOIDs[1]}}},
+			objects: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[0]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj1", ID: testOIDs[1]}},
 			},
 			params: &ListObjectVersionsParams{KeyMarker: "obj0", VersionIDMarker: testOIDs[0].EncodeToString()},
-			expected: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj1", OID: testOIDs[1]}}},
+			expected: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj1", ID: testOIDs[1]}},
 			},
 		},
 		{
 			name: "not matched name alphabetically less",
-			objects: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[0]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj1", OID: testOIDs[1]}}},
+			objects: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[0]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj1", ID: testOIDs[1]}},
 			},
 			params: &ListObjectVersionsParams{KeyMarker: "obj", VersionIDMarker: ""},
-			expected: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[0]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj1", OID: testOIDs[1]}}},
+			expected: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[0]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj1", ID: testOIDs[1]}},
 			},
 		},
 		{
 			name: "not matched name alphabetically less with dummy version id",
-			objects: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[0]}}},
+			objects: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[0]}},
 			},
 			params: &ListObjectVersionsParams{KeyMarker: "obj", VersionIDMarker: "dummy"},
 			error:  true,
 		},
 		{
 			name: "not matched name alphabetically greater",
-			objects: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[0]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj1", OID: testOIDs[1]}}},
+			objects: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[0]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj1", ID: testOIDs[1]}},
 			},
 			params:   &ListObjectVersionsParams{KeyMarker: "obj2", VersionIDMarker: testOIDs[2].EncodeToString()},
-			expected: []*data.ExtendedNodeVersion{},
+			expected: []*data.ExtendedObjectInfo{},
 		},
 		{
 			name: "not found version id",
-			objects: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[0]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[1]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj1", OID: testOIDs[2]}}},
+			objects: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[0]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[1]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj1", ID: testOIDs[2]}},
 			},
 			params: &ListObjectVersionsParams{KeyMarker: "obj0", VersionIDMarker: "dummy"},
 			error:  true,
 		},
 		{
 			name: "not found version id, obj last",
-			objects: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[0]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[1]}}},
+			objects: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[0]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[1]}},
 			},
 			params: &ListObjectVersionsParams{KeyMarker: "obj0", VersionIDMarker: "dummy"},
 			error:  true,
 		},
 		{
 			name: "not found version id, obj last",
-			objects: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[0]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj0", OID: testOIDs[1]}}},
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj1", OID: testOIDs[2]}}},
+			objects: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[0]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj0", ID: testOIDs[1]}},
+				{ObjectInfo: &data.ObjectInfo{Name: "obj1", ID: testOIDs[2]}},
 			},
 			params: &ListObjectVersionsParams{KeyMarker: "obj0", VersionIDMarker: ""},
-			expected: []*data.ExtendedNodeVersion{
-				{NodeVersion: &data.NodeVersion{BaseNodeVersion: data.BaseNodeVersion{FilePath: "obj1", OID: testOIDs[2]}}},
+			expected: []*data.ExtendedObjectInfo{
+				{ObjectInfo: &data.ObjectInfo{Name: "obj1", ID: testOIDs[2]}},
 			},
 		},
 	} {

api/middleware/auth.go

@@ -1,54 +1,21 @@
 package middleware
 
 import (
-	"crypto/elliptic"
-	stderrors "errors"
-	"fmt"
 	"net/http"
-	"time"
 
-	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/acl"
+	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/auth"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/creds/accessbox"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
-	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"go.uber.org/zap"
 )
 
-type (
-	// Box contains access box and additional info.
-	Box struct {
-		AccessBox   *accessbox.Box
-		ClientTime  time.Time
-		AuthHeaders *AuthHeader
-	}
-
-	// Center is a user authentication interface.
-	Center interface {
-		// Authenticate validate and authenticate request.
-		// Must return ErrNoAuthorizationHeader if auth header is missed.
-		Authenticate(request *http.Request) (*Box, error)
-	}
-
-	//nolint:revive
-	AuthHeader struct {
-		AccessKeyID string
-		Region      string
-		SignatureV4 string
-	}
-)
-
-// ErrNoAuthorizationHeader is returned for unauthenticated requests.
-var ErrNoAuthorizationHeader = stderrors.New("no authorization header")
-
-func Auth(center Center, log *zap.Logger) Func {
+func Auth(center auth.Center, log *zap.Logger) Func {
 	return func(h http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			ctx := r.Context()
 			box, err := center.Authenticate(r)
 			if err != nil {
-				if err == ErrNoAuthorizationHeader {
+				if err == auth.ErrNoAuthorizationHeader {
 					reqLogOrDefault(ctx, log).Debug(logs.CouldntReceiveAccessBoxForGateKeyRandomKeyWillBeUsed)
 				} else {
 					reqLogOrDefault(ctx, log).Error(logs.FailedToPassAuthentication, zap.Error(err))
@@ -70,45 +37,3 @@ func Auth(center Center, log *zap.Logger) Func {
 		})
 	}
 }
-
-type FrostFSIDValidator interface {
-	ValidatePublicKey(key *keys.PublicKey) error
-}
-
-func FrostfsIDValidation(frostfsID FrostFSIDValidator, log *zap.Logger) Func {
-	return func(h http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			ctx := r.Context()
-			bd, err := GetBoxData(ctx)
-			if err != nil || bd.Gate.BearerToken == nil {
-				reqLogOrDefault(ctx, log).Debug(logs.AnonRequestSkipFrostfsIDValidation)
-				h.ServeHTTP(w, r)
-				return
-			}
-
-			if err = validateBearerToken(frostfsID, bd.Gate.BearerToken); err != nil {
-				reqLogOrDefault(ctx, log).Error(logs.FrostfsIDValidationFailed, zap.Error(err))
-				WriteErrorResponse(w, GetReqInfo(r.Context()), err)
-				return
-			}
-
-			h.ServeHTTP(w, r)
-		})
-	}
-}
-
-func validateBearerToken(frostfsID FrostFSIDValidator, bt *bearer.Token) error {
-	m := new(acl.BearerToken)
-	bt.WriteToV2(m)
-
-	pk, err := keys.NewPublicKeyFromBytes(m.GetSignature().GetKey(), elliptic.P256())
-	if err != nil {
-		return fmt.Errorf("invalid bearer token public key: %w", err)
-	}
-
-	if err = frostfsID.ValidatePublicKey(pk); err != nil {
-		return fmt.Errorf("validation data user key failed: %w", err)
-	}
-
-	return nil
-}

api/middleware/constants.go

@@ -1,105 +0,0 @@
-package middleware
-
-const (
-	ListBucketsOperation = "ListBuckets"
-
-	// bucket operations.
-
-	OptionsOperation                   = "Options"
-	HeadBucketOperation                = "HeadBucket"
-	ListMultipartUploadsOperation      = "ListMultipartUploads"
-	GetBucketLocationOperation         = "GetBucketLocation"
-	GetBucketPolicyOperation           = "GetBucketPolicy"
-	GetBucketLifecycleOperation        = "GetBucketLifecycle"
-	GetBucketEncryptionOperation       = "GetBucketEncryption"
-	GetBucketCorsOperation             = "GetBucketCors"
-	GetBucketACLOperation              = "GetBucketACL"
-	GetBucketWebsiteOperation          = "GetBucketWebsite"
-	GetBucketAccelerateOperation       = "GetBucketAccelerate"
-	GetBucketRequestPaymentOperation   = "GetBucketRequestPayment"
-	GetBucketLoggingOperation          = "GetBucketLogging"
-	GetBucketReplicationOperation      = "GetBucketReplication"
-	GetBucketTaggingOperation          = "GetBucketTagging"
-	GetBucketObjectLockConfigOperation = "GetBucketObjectLockConfig"
-	GetBucketVersioningOperation       = "GetBucketVersioning"
-	GetBucketNotificationOperation     = "GetBucketNotification"
-	ListenBucketNotificationOperation  = "ListenBucketNotification"
-	ListBucketObjectVersionsOperation  = "ListBucketObjectVersions"
-	ListObjectsV2MOperation            = "ListObjectsV2M"
-	ListObjectsV2Operation             = "ListObjectsV2"
-	ListObjectsV1Operation             = "ListObjectsV1"
-	PutBucketCorsOperation             = "PutBucketCors"
-	PutBucketACLOperation              = "PutBucketACL"
-	PutBucketLifecycleOperation        = "PutBucketLifecycle"
-	PutBucketEncryptionOperation       = "PutBucketEncryption"
-	PutBucketPolicyOperation           = "PutBucketPolicy"
-	PutBucketObjectLockConfigOperation = "PutBucketObjectLockConfig"
-	PutBucketTaggingOperation          = "PutBucketTagging"
-	PutBucketVersioningOperation       = "PutBucketVersioning"
-	PutBucketNotificationOperation     = "PutBucketNotification"
-	CreateBucketOperation              = "CreateBucket"
-	DeleteMultipleObjectsOperation     = "DeleteMultipleObjects"
-	PostObjectOperation                = "PostObject"
-	DeleteBucketCorsOperation          = "DeleteBucketCors"
-	DeleteBucketWebsiteOperation       = "DeleteBucketWebsite"
-	DeleteBucketTaggingOperation       = "DeleteBucketTagging"
-	DeleteBucketPolicyOperation        = "DeleteBucketPolicy"
-	DeleteBucketLifecycleOperation     = "DeleteBucketLifecycle"
-	DeleteBucketEncryptionOperation    = "DeleteBucketEncryption"
-	DeleteBucketOperation              = "DeleteBucket"
-
-	// object operations.
-
-	HeadObjectOperation              = "HeadObject"
-	ListPartsOperation               = "ListParts"
-	GetObjectACLOperation            = "GetObjectACL"
-	GetObjectTaggingOperation        = "GetObjectTagging"
-	GetObjectRetentionOperation      = "GetObjectRetention"
-	GetObjectLegalHoldOperation      = "GetObjectLegalHold"
-	GetObjectAttributesOperation     = "GetObjectAttributes"
-	GetObjectOperation               = "GetObject"
-	UploadPartCopyOperation          = "UploadPartCopy"
-	UploadPartOperation              = "UploadPart"
-	PutObjectACLOperation            = "PutObjectACL"
-	PutObjectTaggingOperation        = "PutObjectTagging"
-	CopyObjectOperation              = "CopyObject"
-	PutObjectRetentionOperation      = "PutObjectRetention"
-	PutObjectLegalHoldOperation      = "PutObjectLegalHold"
-	PutObjectOperation               = "PutObject"
-	CompleteMultipartUploadOperation = "CompleteMultipartUpload"
-	CreateMultipartUploadOperation   = "CreateMultipartUpload"
-	SelectObjectContentOperation     = "SelectObjectContent"
-	AbortMultipartUploadOperation    = "AbortMultipartUpload"
-	DeleteObjectTaggingOperation     = "DeleteObjectTagging"
-	DeleteObjectOperation            = "DeleteObject"
-)
-
-const (
-	UploadsQuery        = "uploads"
-	LocationQuery       = "location"
-	PolicyQuery         = "policy"
-	LifecycleQuery      = "lifecycle"
-	EncryptionQuery     = "encryption"
-	CorsQuery           = "cors"
-	ACLQuery            = "acl"
-	WebsiteQuery        = "website"
-	AccelerateQuery     = "accelerate"
-	RequestPaymentQuery = "requestPayment"
-	LoggingQuery        = "logging"
-	ReplicationQuery    = "replication"
-	TaggingQuery        = "tagging"
-	ObjectLockQuery     = "object-lock"
-	VersioningQuery     = "versioning"
-	NotificationQuery   = "notification"
-	EventsQuery         = "events"
-	VersionsQuery       = "versions"
-	ListTypeQuery       = "list-type"
-	MetadataQuery       = "metadata"
-	DeleteQuery         = "delete"
-	UploadIDQuery       = "uploadId"
-	RetentionQuery      = "retention"
-	LegalQuery          = "legal"
-	AttributesQuery     = "attributes"
-	PartNumberQuery     = "partNumber"
-	LegalHoldQuery      = "legal-hold"
-)

api/middleware/metrics.go

@@ -17,6 +17,10 @@ import (
 )
 
 type (
+	UsersStat interface {
+		Update(user, bucket, cnrID string, reqType int, in, out uint64)
+	}
+
 	readCounter struct {
 		io.ReadCloser
 		countBytes uint64
@@ -35,10 +39,6 @@ type (
 		startTime  time.Time
 	}
 
-	MetricsSettings interface {
-		ResolveNamespaceAlias(namespace string) string
-	}
-
 	// BucketResolveFunc is a func to resolve bucket info by name.
 	BucketResolveFunc func(ctx context.Context, bucket string) (*data.BucketInfo, error)
 
@@ -49,14 +49,14 @@ type (
 const systemPath = "/system"
 
 // Metrics wraps http handler for api with basic statistics collection.
-func Metrics(log *zap.Logger, resolveBucket BucketResolveFunc, appMetrics *metrics.AppMetrics, settings MetricsSettings) Func {
+func Metrics(log *zap.Logger, resolveBucket BucketResolveFunc, appMetrics *metrics.AppMetrics) Func {
 	return func(h http.Handler) http.Handler {
-		return stats(h.ServeHTTP, resolveCID(log, resolveBucket), appMetrics, settings)
+		return stats(h.ServeHTTP, resolveCID(log, resolveBucket), appMetrics)
 	}
 }
 
 // Stats is a handler that update metrics.
-func stats(f http.HandlerFunc, resolveCID cidResolveFunc, appMetrics *metrics.AppMetrics, settings MetricsSettings) http.HandlerFunc {
+func stats(f http.HandlerFunc, resolveCID cidResolveFunc, appMetrics *metrics.AppMetrics) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		reqInfo := GetReqInfo(r.Context())
 
@@ -82,8 +82,7 @@ func stats(f http.HandlerFunc, resolveCID cidResolveFunc, appMetrics *metrics.Ap
 
 		user := resolveUser(r.Context())
 		cnrID := resolveCID(r.Context(), reqInfo)
-		appMetrics.Update(user, reqInfo.BucketName, cnrID, settings.ResolveNamespaceAlias(reqInfo.Namespace),
-			requestTypeFromAPI(reqInfo.API), in.countBytes, out.countBytes)
+		appMetrics.Update(user, reqInfo.BucketName, cnrID, requestTypeFromAPI(reqInfo.API), in.countBytes, out.countBytes)
 
 		code := statsWriter.statusCode
 		// A successful request has a 2xx response code
@@ -95,8 +94,10 @@ func stats(f http.HandlerFunc, resolveCID cidResolveFunc, appMetrics *metrics.Ap
 			}
 		}
 
-		// Increment the prometheus http request response histogram with appropriate label
-		appMetrics.Statistic().RequestDurationsUpdate(reqInfo.API, durationSecs)
+		if r.Method == http.MethodGet {
+			// Increment the prometheus http request response histogram with appropriate label
+			appMetrics.Statistic().RequestDurationsUpdate(reqInfo.API, durationSecs)
+		}
 
 		appMetrics.Statistic().TotalInputBytesAdd(in.countBytes)
 		appMetrics.Statistic().TotalOutputBytesAdd(out.countBytes)
@@ -105,27 +106,27 @@ func stats(f http.HandlerFunc, resolveCID cidResolveFunc, appMetrics *metrics.Ap
 
 func requestTypeFromAPI(api string) metrics.RequestType {
 	switch api {
-	case OptionsOperation, HeadObjectOperation, HeadBucketOperation:
+	case "Options", "HeadObject", "HeadBucket":
 		return metrics.HEADRequest
-	case CreateMultipartUploadOperation, UploadPartCopyOperation, UploadPartOperation, CompleteMultipartUploadOperation,
-		PutObjectACLOperation, PutObjectTaggingOperation, CopyObjectOperation, PutObjectRetentionOperation, PutObjectLegalHoldOperation,
-		PutObjectOperation, PutBucketCorsOperation, PutBucketACLOperation, PutBucketLifecycleOperation, PutBucketEncryptionOperation,
-		PutBucketPolicyOperation, PutBucketObjectLockConfigOperation, PutBucketTaggingOperation, PutBucketVersioningOperation,
-		PutBucketNotificationOperation, CreateBucketOperation, PostObjectOperation:
+	case "CreateMultipartUpload", "UploadPartCopy", "UploadPart", "CompleteMultipartUpload",
+		"PutObjectACL", "PutObjectTagging", "CopyObject", "PutObjectRetention", "PutObjectLegalHold",
+		"PutObject", "PutBucketCors", "PutBucketACL", "PutBucketLifecycle", "PutBucketEncryption",
+		"PutBucketPolicy", "PutBucketObjectLockConfig", "PutBucketTagging", "PutBucketVersioning",
+		"PutBucketNotification", "CreateBucket", "PostObject":
 		return metrics.PUTRequest
-	case ListPartsOperation, ListMultipartUploadsOperation, ListObjectsV2MOperation, ListObjectsV2Operation,
-		ListObjectsV1Operation, ListBucketsOperation:
+	case "ListObjectParts", "ListMultipartUploads", "ListObjectsV2M", "ListObjectsV2", "ListBucketVersions",
+		"ListObjectsV1", "ListBuckets":
 		return metrics.LISTRequest
-	case GetObjectACLOperation, GetObjectTaggingOperation, SelectObjectContentOperation, GetObjectRetentionOperation, GetObjectLegalHoldOperation,
-		GetObjectAttributesOperation, GetObjectOperation, GetBucketLocationOperation, GetBucketPolicyOperation,
-		GetBucketLifecycleOperation, GetBucketEncryptionOperation, GetBucketCorsOperation, GetBucketACLOperation,
-		GetBucketWebsiteOperation, GetBucketAccelerateOperation, GetBucketRequestPaymentOperation, GetBucketLoggingOperation,
-		GetBucketReplicationOperation, GetBucketTaggingOperation, GetBucketObjectLockConfigOperation,
-		GetBucketVersioningOperation, GetBucketNotificationOperation, ListenBucketNotificationOperation:
+	case "GetObjectACL", "GetObjectTagging", "SelectObjectContent", "GetObjectRetention", "getobjectlegalhold",
+		"GetObjectAttributes", "GetObject", "GetBucketLocation", "GetBucketPolicy",
+		"GetBucketLifecycle", "GetBucketEncryption", "GetBucketCors", "GetBucketACL",
+		"GetBucketWebsite", "GetBucketAccelerate", "GetBucketRequestPayment", "GetBucketLogging",
+		"GetBucketReplication", "GetBucketTagging", "GetBucketObjectLockConfig",
+		"GetBucketVersioning", "GetBucketNotification", "ListenBucketNotification":
 		return metrics.GETRequest
-	case AbortMultipartUploadOperation, DeleteObjectTaggingOperation, DeleteObjectOperation, DeleteBucketCorsOperation,
-		DeleteBucketWebsiteOperation, DeleteBucketTaggingOperation, DeleteMultipleObjectsOperation, DeleteBucketPolicyOperation,
-		DeleteBucketLifecycleOperation, DeleteBucketEncryptionOperation, DeleteBucketOperation:
+	case "AbortMultipartUpload", "DeleteObjectTagging", "DeleteObject", "DeleteBucketCors",
+		"DeleteBucketWebsite", "DeleteBucketTagging", "DeleteMultipleObjects", "DeleteBucketPolicy",
+		"DeleteBucketLifecycle", "DeleteBucketEncryption", "DeleteBucket":
 		return metrics.DELETERequest
 	default:
 		return metrics.UNKNOWNRequest
@@ -135,7 +136,7 @@ func requestTypeFromAPI(api string) metrics.RequestType {
 // resolveCID forms CIDResolveFunc using BucketResolveFunc.
 func resolveCID(log *zap.Logger, resolveBucket BucketResolveFunc) cidResolveFunc {
 	return func(ctx context.Context, reqInfo *ReqInfo) (cnrID string) {
-		if reqInfo.BucketName == "" || reqInfo.API == CreateBucketOperation || reqInfo.API == "" {
+		if reqInfo.BucketName == "" || reqInfo.API == "CreateBucket" || reqInfo.API == "" {
 			return ""
 		}
 

api/middleware/policy.go

@@ -1,335 +0,0 @@
-package middleware
-
-import (
-	"crypto/elliptic"
-	"fmt"
-	"net/http"
-	"strings"
-
-	apiErr "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/resource/testutil"
-	"git.frostfs.info/TrueCloudLab/policy-engine/schema/common"
-	"git.frostfs.info/TrueCloudLab/policy-engine/schema/s3"
-	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
-	"github.com/nspcc-dev/neo-go/pkg/util"
-	"go.uber.org/zap"
-)
-
-type PolicySettings interface {
-	ResolveNamespaceAlias(ns string) string
-	PolicyDenyByDefault() bool
-}
-
-type FrostFSIDInformer interface {
-	GetUserGroupIDs(userHash util.Uint160) ([]string, error)
-}
-
-func PolicyCheck(storage engine.ChainRouter, frostfsid FrostFSIDInformer, settings PolicySettings, domains []string, log *zap.Logger) Func {
-	return func(h http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			ctx := r.Context()
-
-			st, err := policyCheck(storage, frostfsid, settings, domains, r)
-			if err == nil {
-				if st != chain.Allow && (st != chain.NoRuleFound || settings.PolicyDenyByDefault()) {
-					err = apiErr.GetAPIErrorWithError(apiErr.ErrAccessDenied, fmt.Errorf("policy check: %s", st.String()))
-				}
-			}
-			if err != nil {
-				reqLogOrDefault(ctx, log).Error(logs.PolicyValidationFailed, zap.Error(err))
-				WriteErrorResponse(w, GetReqInfo(ctx), err)
-				return
-			}
-
-			h.ServeHTTP(w, r)
-		})
-	}
-}
-
-func policyCheck(storage engine.ChainRouter, frostfsid FrostFSIDInformer, settings PolicySettings, domains []string, r *http.Request) (chain.Status, error) {
-	req, err := getPolicyRequest(r, frostfsid, domains)
-	if err != nil {
-		return 0, err
-	}
-
-	reqInfo := GetReqInfo(r.Context())
-	target := engine.NewRequestTargetWithNamespace(settings.ResolveNamespaceAlias(reqInfo.Namespace))
-	st, found, err := storage.IsAllowed(chain.S3, target, req)
-	if err != nil {
-		return 0, err
-	}
-
-	if !found {
-		st = chain.NoRuleFound
-	}
-
-	return st, nil
-}
-
-func getPolicyRequest(r *http.Request, frostfsid FrostFSIDInformer, domains []string) (*testutil.Request, error) {
-	var (
-		owner  string
-		groups []string
-	)
-
-	ctx := r.Context()
-	bd, err := GetBoxData(ctx)
-	if err == nil && bd.Gate.BearerToken != nil {
-		pk, err := keys.NewPublicKeyFromBytes(bd.Gate.BearerToken.SigningKeyBytes(), elliptic.P256())
-		if err != nil {
-			return nil, fmt.Errorf("parse pubclic key from btoken: %w", err)
-		}
-		owner = pk.Address()
-
-		groups, err = frostfsid.GetUserGroupIDs(pk.GetScriptHash())
-		if err != nil {
-			return nil, fmt.Errorf("get group ids: %w", err)
-		}
-	}
-
-	op, res := determineOperationAndResource(r, domains)
-
-	return testutil.NewRequest(op, testutil.NewResource(res, nil),
-		map[string]string{
-			s3.PropertyKeyOwner:                owner,
-			common.PropertyKeyFrostFSIDGroupID: chain.FormCondSliceContainsValue(groups),
-		},
-	), nil
-}
-
-type ReqType int
-
-const (
-	noneType ReqType = iota
-	bucketType
-	objectType
-)
-
-func determineOperationAndResource(r *http.Request, domains []string) (operation string, resource string) {
-	var (
-		reqType     ReqType
-		matchDomain bool
-	)
-
-	for _, domain := range domains {
-		ind := strings.Index(r.Host, "."+domain)
-		if ind == -1 {
-			continue
-		}
-
-		matchDomain = true
-		reqType = bucketType
-		bkt := r.Host[:ind]
-		if obj := strings.TrimPrefix(r.URL.Path, "/"); obj != "" {
-			reqType = objectType
-			resource = fmt.Sprintf(s3.ResourceFormatS3BucketObject, bkt, obj)
-		} else {
-			resource = fmt.Sprintf(s3.ResourceFormatS3Bucket, bkt)
-		}
-
-		break
-	}
-
-	if !matchDomain {
-		bktObj := strings.TrimPrefix(r.URL.Path, "/")
-		if ind := strings.IndexByte(bktObj, '/'); ind == -1 {
-			reqType = bucketType
-			resource = fmt.Sprintf(s3.ResourceFormatS3Bucket, bktObj)
-			if bktObj == "" {
-				reqType = noneType
-			}
-		} else {
-			reqType = objectType
-			resource = fmt.Sprintf(s3.ResourceFormatS3BucketObject, bktObj[:ind], bktObj[ind+1:])
-		}
-	}
-
-	switch reqType {
-	case objectType:
-		operation = determineObjectOperation(r)
-	case bucketType:
-		operation = determineBucketOperation(r)
-	default:
-		operation = determineGeneralOperation(r)
-	}
-
-	return "s3:" + operation, resource
-}
-
-func determineBucketOperation(r *http.Request) string {
-	query := r.URL.Query()
-	switch r.Method {
-	case http.MethodOptions:
-		return OptionsOperation
-	case http.MethodHead:
-		return HeadBucketOperation
-	case http.MethodGet:
-		switch {
-		case query.Has(UploadsQuery):
-			return ListMultipartUploadsOperation
-		case query.Has(LocationQuery):
-			return GetBucketLocationOperation
-		case query.Has(PolicyQuery):
-			return GetBucketPolicyOperation
-		case query.Has(LifecycleQuery):
-			return GetBucketLifecycleOperation
-		case query.Has(EncryptionQuery):
-			return GetBucketEncryptionOperation
-		case query.Has(CorsQuery):
-			return GetBucketCorsOperation
-		case query.Has(ACLQuery):
-			return GetBucketACLOperation
-		case query.Has(WebsiteQuery):
-			return GetBucketWebsiteOperation
-		case query.Has(AccelerateQuery):
-			return GetBucketAccelerateOperation
-		case query.Has(RequestPaymentQuery):
-			return GetBucketRequestPaymentOperation
-		case query.Has(LoggingQuery):
-			return GetBucketLoggingOperation
-		case query.Has(ReplicationQuery):
-			return GetBucketReplicationOperation
-		case query.Has(TaggingQuery):
-			return GetBucketTaggingOperation
-		case query.Has(ObjectLockQuery):
-			return GetBucketObjectLockConfigOperation
-		case query.Has(VersioningQuery):
-			return GetBucketVersioningOperation
-		case query.Has(NotificationQuery):
-			return GetBucketNotificationOperation
-		case query.Has(EventsQuery):
-			return ListenBucketNotificationOperation
-		case query.Has(VersionsQuery):
-			return ListBucketObjectVersionsOperation
-		case query.Get(ListTypeQuery) == "2" && query.Get(MetadataQuery) == "true":
-			return ListObjectsV2MOperation
-		case query.Get(ListTypeQuery) == "2":
-			return ListObjectsV2Operation
-		default:
-			return ListObjectsV1Operation
-		}
-	case http.MethodPut:
-		switch {
-		case query.Has(CorsQuery):
-			return PutBucketCorsOperation
-		case query.Has(ACLQuery):
-			return PutBucketACLOperation
-		case query.Has(LifecycleQuery):
-			return PutBucketLifecycleOperation
-		case query.Has(EncryptionQuery):
-			return PutBucketEncryptionOperation
-		case query.Has(PolicyQuery):
-			return PutBucketPolicyOperation
-		case query.Has(ObjectLockQuery):
-			return PutBucketObjectLockConfigOperation
-		case query.Has(TaggingQuery):
-			return PutBucketTaggingOperation
-		case query.Has(VersioningQuery):
-			return PutBucketVersioningOperation
-		case query.Has(NotificationQuery):
-			return PutBucketNotificationOperation
-		default:
-			return CreateBucketOperation
-		}
-	case http.MethodPost:
-		switch {
-		case query.Has(DeleteQuery):
-			return DeleteMultipleObjectsOperation
-		default:
-			return PostObjectOperation
-		}
-	case http.MethodDelete:
-		switch {
-		case query.Has(CorsQuery):
-			return DeleteBucketCorsOperation
-		case query.Has(WebsiteQuery):
-			return DeleteBucketWebsiteOperation
-		case query.Has(TaggingQuery):
-			return DeleteBucketTaggingOperation
-		case query.Has(PolicyQuery):
-			return DeleteBucketPolicyOperation
-		case query.Has(LifecycleQuery):
-			return DeleteBucketLifecycleOperation
-		case query.Has(EncryptionQuery):
-			return DeleteBucketEncryptionOperation
-		default:
-			return DeleteBucketOperation
-		}
-	}
-
-	return ""
-}
-
-func determineObjectOperation(r *http.Request) string {
-	query := r.URL.Query()
-	switch r.Method {
-	case http.MethodHead:
-		return HeadObjectOperation
-	case http.MethodGet:
-		switch {
-		case query.Has(UploadIDQuery):
-			return ListPartsOperation
-		case query.Has(ACLQuery):
-			return GetObjectACLOperation
-		case query.Has(TaggingQuery):
-			return GetObjectTaggingOperation
-		case query.Has(RetentionQuery):
-			return GetObjectRetentionOperation
-		case query.Has(LegalQuery):
-			return GetObjectLegalHoldOperation
-		case query.Has(AttributesQuery):
-			return GetObjectAttributesOperation
-		default:
-			return GetObjectOperation
-		}
-	case http.MethodPut:
-		switch {
-		case query.Has(PartNumberQuery) && query.Has(UploadIDQuery) && r.Header.Get("X-Amz-Copy-Source") != "":
-			return UploadPartCopyOperation
-		case query.Has(PartNumberQuery) && query.Has(UploadIDQuery):
-			return UploadPartOperation
-		case query.Has(ACLQuery):
-			return PutObjectACLOperation
-		case query.Has(TaggingQuery):
-			return PutObjectTaggingOperation
-		case r.Header.Get("X-Amz-Copy-Source") != "":
-			return CopyObjectOperation
-		case query.Has(RetentionQuery):
-			return PutObjectRetentionOperation
-		case query.Has(LegalHoldQuery):
-			return PutObjectLegalHoldOperation
-		default:
-			return PutObjectOperation
-		}
-	case http.MethodPost:
-		switch {
-		case query.Has(UploadIDQuery):
-			return CompleteMultipartUploadOperation
-		case query.Has(UploadsQuery):
-			return CreateMultipartUploadOperation
-		default:
-			return SelectObjectContentOperation
-		}
-	case http.MethodDelete:
-		switch {
-		case query.Has(UploadIDQuery):
-			return AbortMultipartUploadOperation
-		case query.Has(TaggingQuery):
-			return DeleteObjectTaggingOperation
-		default:
-			return DeleteObjectOperation
-		}
-	}
-
-	return ""
-}
-
-func determineGeneralOperation(r *http.Request) string {
-	if r.Method == http.MethodGet {
-		return ListBucketsOperation
-	}
-	return ""
-}

api/middleware/reqinfo.go

@@ -9,9 +9,7 @@ import (
 	"strings"
 	"sync"
 
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
-	treepool "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/pool/tree"
 	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 	"go.uber.org/zap"
@@ -38,7 +36,6 @@ type (
 		ObjectName   string   // Object name
 		TraceID      string   // Trace ID
 		URL          *url.URL // Request url
-		Namespace    string
 		tags         []KeyVal // Any additional info not accommodated by above fields
 	}
 
@@ -188,11 +185,7 @@ func GetReqLog(ctx context.Context) *zap.Logger {
 	return nil
 }
 
-type RequestSettings interface {
-	NamespaceHeader() string
-}
-
-func Request(log *zap.Logger, settings RequestSettings) Func {
+func Request(log *zap.Logger) Func {
 	return func(h http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			// generate random UUIDv4
@@ -206,7 +199,6 @@ func Request(log *zap.Logger, settings RequestSettings) Func {
 			// set request info into context
 			// bucket name and object will be set in reqInfo later (limitation of go-chi)
 			reqInfo := NewReqInfo(w, r, ObjectRequest{})
-			reqInfo.Namespace = r.Header.Get(settings.NamespaceHeader())
 			r = r.WithContext(SetReqInfo(r.Context(), reqInfo))
 
 			// set request id into gRPC meta header
@@ -214,8 +206,6 @@ func Request(log *zap.Logger, settings RequestSettings) Func {
 				r.Context(), HdrAmzRequestID, reqInfo.RequestID,
 			))
 
-			r = r.WithContext(treepool.SetRequestID(r.Context(), reqInfo.RequestID))
-
 			reqLogger := log.With(zap.String("request_id", reqInfo.RequestID))
 			r = r.WithContext(SetReqLogger(r.Context(), reqLogger))
 
@@ -303,7 +293,7 @@ func getSourceIP(r *http.Request) string {
 		if match := forRegex.FindStringSubmatch(fwd); len(match) > 1 {
 			// IPv6 addresses in Forwarded headers are quoted-strings. We strip
 			// these quotes.
-			addr = data.UnQuote(match[1])
+			addr = strings.Trim(match[1], `"`)
 		}
 	}
 

api/middleware/response.go

@@ -129,6 +129,8 @@ func WriteErrorResponse(w http.ResponseWriter, reqInfo *ReqInfo, err error) int
 			// Set retry-after header to indicate user-agents to retry request after 120secs.
 			// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Retry-After
 			w.Header().Set(hdrRetryAfter, "120")
+		case "AccessDenied":
+			// TODO process when the request is from browser and also if browser
 		}
 	}
 

api/middleware/util.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"time"
 
+	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/auth"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/creds/accessbox"
 )
 
@@ -36,8 +37,8 @@ func GetBoxData(ctx context.Context) (*accessbox.Box, error) {
 }
 
 // GetAuthHeaders extracts auth.AuthHeader from context.
-func GetAuthHeaders(ctx context.Context) (*AuthHeader, error) {
-	authHeaders, ok := ctx.Value(authHeadersKey).(*AuthHeader)
+func GetAuthHeaders(ctx context.Context) (*auth.AuthHeader, error) {
+	authHeaders, ok := ctx.Value(authHeadersKey).(*auth.AuthHeader)
 	if !ok {
 		return nil, fmt.Errorf("couldn't get auth headers from context")
 	}
@@ -61,7 +62,7 @@ func SetBoxData(ctx context.Context, box *accessbox.Box) context.Context {
 }
 
 // SetAuthHeaders sets auth.AuthHeader in the context.
-func SetAuthHeaders(ctx context.Context, header *AuthHeader) context.Context {
+func SetAuthHeaders(ctx context.Context, header *auth.AuthHeader) context.Context {
 	return context.WithValue(ctx, authHeadersKey, header)
 }
 

api/resolver/resolver.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"sync"
 
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/middleware"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/ns"
@@ -29,21 +28,12 @@ type FrostFS interface {
 	SystemDNS(context.Context) (string, error)
 }
 
-type Settings interface {
-	FormContainerZone(ns string) (zone string, isDefault bool)
-}
-
 type Config struct {
 	FrostFS    FrostFS
 	RPCAddress string
-	Settings   Settings
 }
 
 type BucketResolver struct {
-	rpcAddress string
-	frostfs    FrostFS
-	settings   Settings
-
 	mu        sync.RWMutex
 	resolvers []*Resolver
 }
@@ -68,9 +58,7 @@ func NewBucketResolver(resolverNames []string, cfg *Config) (*BucketResolver, er
 	}
 
 	return &BucketResolver{
-		rpcAddress: cfg.RPCAddress,
-		frostfs:    cfg.FrostFS,
-		resolvers:  resolvers,
+		resolvers: resolvers,
 	}, nil
 }
 
@@ -112,7 +100,7 @@ func (r *BucketResolver) Resolve(ctx context.Context, bktName string) (cnrID cid
 	return cnrID, ErrNoResolvers
 }
 
-func (r *BucketResolver) UpdateResolvers(resolverNames []string) error {
+func (r *BucketResolver) UpdateResolvers(resolverNames []string, cfg *Config) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
@@ -120,12 +108,6 @@ func (r *BucketResolver) UpdateResolvers(resolverNames []string) error {
 		return nil
 	}
 
-	cfg := &Config{
-		FrostFS:    r.frostfs,
-		RPCAddress: r.rpcAddress,
-		Settings:   r.settings,
-	}
-
 	resolvers, err := createResolvers(resolverNames, cfg)
 	if err != nil {
 		return err
@@ -152,37 +134,28 @@ func (r *BucketResolver) equals(resolverNames []string) bool {
 func newResolver(name string, cfg *Config) (*Resolver, error) {
 	switch name {
 	case DNSResolver:
-		return NewDNSResolver(cfg.FrostFS, cfg.Settings)
+		return NewDNSResolver(cfg.FrostFS)
 	case NNSResolver:
-		return NewNNSResolver(cfg.RPCAddress, cfg.Settings)
+		return NewNNSResolver(cfg.RPCAddress)
 	default:
 		return nil, fmt.Errorf("unknown resolver: %s", name)
 	}
 }
 
-func NewDNSResolver(frostFS FrostFS, settings Settings) (*Resolver, error) {
+func NewDNSResolver(frostFS FrostFS) (*Resolver, error) {
 	if frostFS == nil {
 		return nil, fmt.Errorf("pool must not be nil for DNS resolver")
 	}
-	if settings == nil {
-		return nil, fmt.Errorf("resolver settings must not be nil for DNS resolver")
-	}
 
 	var dns ns.DNS
 
 	resolveFunc := func(ctx context.Context, name string) (cid.ID, error) {
-		var err error
-		reqInfo := middleware.GetReqInfo(ctx)
-
-		zone, isDefault := settings.FormContainerZone(reqInfo.Namespace)
-		if isDefault {
-			zone, err = frostFS.SystemDNS(ctx)
-			if err != nil {
-				return cid.ID{}, fmt.Errorf("read system DNS parameter of the FrostFS: %w", err)
-			}
+		domain, err := frostFS.SystemDNS(ctx)
+		if err != nil {
+			return cid.ID{}, fmt.Errorf("read system DNS parameter of the FrostFS: %w", err)
 		}
 
-		domain := name + "." + zone
+		domain = name + "." + domain
 		cnrID, err := dns.ResolveContainerName(domain)
 		if err != nil {
 			return cid.ID{}, fmt.Errorf("couldn't resolve container '%s' as '%s': %w", name, domain, err)
@@ -196,13 +169,10 @@ func NewDNSResolver(frostFS FrostFS, settings Settings) (*Resolver, error) {
 	}, nil
 }
 
-func NewNNSResolver(address string, settings Settings) (*Resolver, error) {
+func NewNNSResolver(address string) (*Resolver, error) {
 	if address == "" {
 		return nil, fmt.Errorf("rpc address must not be empty for NNS resolver")
 	}
-	if settings == nil {
-		return nil, fmt.Errorf("resolver settings must not be nil for NNS resolver")
-	}
 
 	var nns ns.NNS
 
@@ -210,14 +180,10 @@ func NewNNSResolver(address string, settings Settings) (*Resolver, error) {
 		return nil, fmt.Errorf("dial %s: %w", address, err)
 	}
 
-	resolveFunc := func(ctx context.Context, name string) (cid.ID, error) {
+	resolveFunc := func(_ context.Context, name string) (cid.ID, error) {
 		var d container.Domain
 		d.SetName(name)
 
-		reqInfo := middleware.GetReqInfo(ctx)
-		zone, _ := settings.FormContainerZone(reqInfo.Namespace)
-		d.SetZone(zone)
-
 		cnrID, err := nns.ResolveContainerDomain(d)
 		if err != nil {
 			return cid.ID{}, fmt.Errorf("couldn't resolve container '%s': %w", name, err)

api/router.go

@@ -5,12 +5,12 @@ import (
 	"fmt"
 	"net/http"
 
+	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/auth"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
 	s3middleware "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/middleware"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/metrics"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 	"go.uber.org/zap"
@@ -90,68 +90,29 @@ type (
 	}
 )
 
-type Settings interface {
-	s3middleware.RequestSettings
-	s3middleware.PolicySettings
-	s3middleware.MetricsSettings
-}
-
-type FrostFSID interface {
-	s3middleware.FrostFSIDValidator
-	s3middleware.FrostFSIDInformer
-}
-
-type Config struct {
-	Throttle middleware.ThrottleOpts
-	Handler  Handler
-	Center   s3middleware.Center
-	Log      *zap.Logger
-	Metrics  *metrics.AppMetrics
-
-	MiddlewareSettings Settings
-
-	// Domains optional. If empty no virtual hosted domains will be attached.
-	Domains []string
-
-	FrostfsID FrostFSID
-
-	FrostFSIDValidation bool
-
-	PolicyChecker engine.ChainRouter
-}
-
-func NewRouter(cfg Config) *chi.Mux {
-	api := chi.NewRouter()
+func AttachChi(api *chi.Mux, domains []string, throttle middleware.ThrottleOpts, h Handler, center auth.Center, log *zap.Logger, appMetrics *metrics.AppMetrics) {
 	api.Use(
-		s3middleware.Request(cfg.Log, cfg.MiddlewareSettings),
-		middleware.ThrottleWithOpts(cfg.Throttle),
+		s3middleware.Request(log),
+		middleware.ThrottleWithOpts(throttle),
 		middleware.Recoverer,
 		s3middleware.Tracing(),
-		s3middleware.Metrics(cfg.Log, cfg.Handler.ResolveBucket, cfg.Metrics, cfg.MiddlewareSettings),
-		s3middleware.LogSuccessResponse(cfg.Log),
-		s3middleware.Auth(cfg.Center, cfg.Log),
+		s3middleware.Metrics(log, h.ResolveBucket, appMetrics),
+		s3middleware.LogSuccessResponse(log),
+		s3middleware.Auth(center, log),
 	)
 
-	if cfg.FrostFSIDValidation {
-		api.Use(s3middleware.FrostfsIDValidation(cfg.FrostfsID, cfg.Log))
-	}
-
-	api.Use(s3middleware.PolicyCheck(cfg.PolicyChecker, cfg.FrostfsID, cfg.MiddlewareSettings, cfg.Domains, cfg.Log))
-
 	defaultRouter := chi.NewRouter()
-	defaultRouter.Mount(fmt.Sprintf("/{%s}", s3middleware.BucketURLPrm), bucketRouter(cfg.Handler, cfg.Log))
-	defaultRouter.Get("/", named("ListBuckets", cfg.Handler.ListBucketsHandler))
+	defaultRouter.Mount(fmt.Sprintf("/{%s}", s3middleware.BucketURLPrm), bucketRouter(h, log))
+	defaultRouter.Get("/", named("ListBuckets", h.ListBucketsHandler))
 
 	hr := NewHostBucketRouter("bucket")
 	hr.Default(defaultRouter)
-	for _, domain := range cfg.Domains {
-		hr.Map(domain, bucketRouter(cfg.Handler, cfg.Log))
+	for _, domain := range domains {
+		hr.Map(domain, bucketRouter(h, log))
 	}
 	api.Mount("/", hr)
 
 	attachErrorHandler(api)
-
-	return api
 }
 
 func named(name string, handlerFunc http.HandlerFunc) http.HandlerFunc {
@@ -199,139 +160,139 @@ func bucketRouter(h Handler, log *zap.Logger) chi.Router {
 
 	bktRouter.Options("/", h.Preflight)
 
-	bktRouter.Head("/", named(s3middleware.HeadBucketOperation, h.HeadBucketHandler))
+	bktRouter.Head("/", named("HeadBucket", h.HeadBucketHandler))
 
 	// GET method handlers
 	bktRouter.Group(func(r chi.Router) {
 		r.Method(http.MethodGet, "/", NewHandlerFilter().
 			Add(NewFilter().
-				Queries(s3middleware.UploadsQuery).
-				Handler(named(s3middleware.ListMultipartUploadsOperation, h.ListMultipartUploadsHandler))).
+				Queries("uploads").
+				Handler(named("ListMultipartUploads", h.ListMultipartUploadsHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.LocationQuery).
-				Handler(named(s3middleware.GetBucketLocationOperation, h.GetBucketLocationHandler))).
+				Queries("location").
+				Handler(named("GetBucketLocation", h.GetBucketLocationHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.PolicyQuery).
-				Handler(named(s3middleware.GetBucketPolicyOperation, h.GetBucketPolicyHandler))).
+				Queries("policy").
+				Handler(named("GetBucketPolicy", h.GetBucketPolicyHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.LifecycleQuery).
-				Handler(named(s3middleware.GetBucketLifecycleOperation, h.GetBucketLifecycleHandler))).
+				Queries("lifecycle").
+				Handler(named("GetBucketLifecycle", h.GetBucketLifecycleHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.EncryptionQuery).
-				Handler(named(s3middleware.GetBucketEncryptionOperation, h.GetBucketEncryptionHandler))).
+				Queries("encryption").
+				Handler(named("GetBucketEncryption", h.GetBucketEncryptionHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.CorsQuery).
-				Handler(named(s3middleware.GetBucketCorsOperation, h.GetBucketCorsHandler))).
+				Queries("cors").
+				Handler(named("GetBucketCors", h.GetBucketCorsHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.ACLQuery).
-				Handler(named(s3middleware.GetBucketACLOperation, h.GetBucketACLHandler))).
+				Queries("acl").
+				Handler(named("GetBucketACL", h.GetBucketACLHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.WebsiteQuery).
-				Handler(named(s3middleware.GetBucketWebsiteOperation, h.GetBucketWebsiteHandler))).
+				Queries("website").
+				Handler(named("GetBucketWebsite", h.GetBucketWebsiteHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.AccelerateQuery).
-				Handler(named(s3middleware.GetBucketAccelerateOperation, h.GetBucketAccelerateHandler))).
+				Queries("accelerate").
+				Handler(named("GetBucketAccelerate", h.GetBucketAccelerateHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.RequestPaymentQuery).
-				Handler(named(s3middleware.GetBucketRequestPaymentOperation, h.GetBucketRequestPaymentHandler))).
+				Queries("requestPayment").
+				Handler(named("GetBucketRequestPayment", h.GetBucketRequestPaymentHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.LoggingQuery).
-				Handler(named(s3middleware.GetBucketLoggingOperation, h.GetBucketLoggingHandler))).
+				Queries("logging").
+				Handler(named("GetBucketLogging", h.GetBucketLoggingHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.ReplicationQuery).
-				Handler(named(s3middleware.GetBucketReplicationOperation, h.GetBucketReplicationHandler))).
+				Queries("replication").
+				Handler(named("GetBucketReplication", h.GetBucketReplicationHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.TaggingQuery).
-				Handler(named(s3middleware.GetBucketTaggingOperation, h.GetBucketTaggingHandler))).
+				Queries("tagging").
+				Handler(named("GetBucketTagging", h.GetBucketTaggingHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.ObjectLockQuery).
-				Handler(named(s3middleware.GetBucketObjectLockConfigOperation, h.GetBucketObjectLockConfigHandler))).
+				Queries("object-lock").
+				Handler(named("GetBucketObjectLockConfig", h.GetBucketObjectLockConfigHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.VersioningQuery).
-				Handler(named(s3middleware.GetBucketVersioningOperation, h.GetBucketVersioningHandler))).
+				Queries("versioning").
+				Handler(named("GetBucketVersioning", h.GetBucketVersioningHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.NotificationQuery).
-				Handler(named(s3middleware.GetBucketNotificationOperation, h.GetBucketNotificationHandler))).
+				Queries("notification").
+				Handler(named("GetBucketNotification", h.GetBucketNotificationHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.EventsQuery).
-				Handler(named(s3middleware.ListenBucketNotificationOperation, h.ListenBucketNotificationHandler))).
+				Queries("events").
+				Handler(named("ListenBucketNotification", h.ListenBucketNotificationHandler))).
 			Add(NewFilter().
-				QueriesMatch(s3middleware.ListTypeQuery, "2", s3middleware.MetadataQuery, "true").
-				Handler(named(s3middleware.ListObjectsV2MOperation, h.ListObjectsV2MHandler))).
+				QueriesMatch("list-type", "2", "metadata", "true").
+				Handler(named("ListObjectsV2M", h.ListObjectsV2MHandler))).
 			Add(NewFilter().
-				QueriesMatch(s3middleware.ListTypeQuery, "2").
-				Handler(named(s3middleware.ListObjectsV2Operation, h.ListObjectsV2Handler))).
+				QueriesMatch("list-type", "2").
+				Handler(named("ListObjectsV2", h.ListObjectsV2Handler))).
 			Add(NewFilter().
-				Queries(s3middleware.VersionsQuery).
-				Handler(named(s3middleware.ListBucketObjectVersionsOperation, h.ListBucketObjectVersionsHandler))).
-			DefaultHandler(named(s3middleware.ListObjectsV1Operation, h.ListObjectsV1Handler)))
+				Queries("versions").
+				Handler(named("ListBucketObjectVersions", h.ListBucketObjectVersionsHandler))).
+			DefaultHandler(named("ListObjectsV1", h.ListObjectsV1Handler)))
 	})
 
 	// PUT method handlers
 	bktRouter.Group(func(r chi.Router) {
 		r.Method(http.MethodPut, "/", NewHandlerFilter().
 			Add(NewFilter().
-				Queries(s3middleware.CorsQuery).
-				Handler(named(s3middleware.PutBucketCorsOperation, h.PutBucketCorsHandler))).
+				Queries("cors").
+				Handler(named("PutBucketCors", h.PutBucketCorsHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.ACLQuery).
-				Handler(named(s3middleware.PutBucketACLOperation, h.PutBucketACLHandler))).
+				Queries("acl").
+				Handler(named("PutBucketACL", h.PutBucketACLHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.LifecycleQuery).
-				Handler(named(s3middleware.PutBucketLifecycleOperation, h.PutBucketLifecycleHandler))).
+				Queries("lifecycle").
+				Handler(named("PutBucketLifecycle", h.PutBucketLifecycleHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.EncryptionQuery).
-				Handler(named(s3middleware.PutBucketEncryptionOperation, h.PutBucketEncryptionHandler))).
+				Queries("encryption").
+				Handler(named("PutBucketEncryption", h.PutBucketEncryptionHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.PolicyQuery).
-				Handler(named(s3middleware.PutBucketPolicyOperation, h.PutBucketPolicyHandler))).
+				Queries("policy").
+				Handler(named("PutBucketPolicy", h.PutBucketPolicyHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.ObjectLockQuery).
-				Handler(named(s3middleware.PutBucketObjectLockConfigOperation, h.PutBucketObjectLockConfigHandler))).
+				Queries("object-lock").
+				Handler(named("PutBucketObjectLockConfig", h.PutBucketObjectLockConfigHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.TaggingQuery).
-				Handler(named(s3middleware.PutBucketTaggingOperation, h.PutBucketTaggingHandler))).
+				Queries("tagging").
+				Handler(named("PutBucketTagging", h.PutBucketTaggingHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.VersioningQuery).
-				Handler(named(s3middleware.PutBucketVersioningOperation, h.PutBucketVersioningHandler))).
+				Queries("versioning").
+				Handler(named("PutBucketVersioning", h.PutBucketVersioningHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.NotificationQuery).
-				Handler(named(s3middleware.PutBucketNotificationOperation, h.PutBucketNotificationHandler))).
-			DefaultHandler(named(s3middleware.CreateBucketOperation, h.CreateBucketHandler)))
+				Queries("notification").
+				Handler(named("PutBucketNotification", h.PutBucketNotificationHandler))).
+			DefaultHandler(named("CreateBucket", h.CreateBucketHandler)))
 	})
 
 	// POST method handlers
 	bktRouter.Group(func(r chi.Router) {
 		r.Method(http.MethodPost, "/", NewHandlerFilter().
 			Add(NewFilter().
-				Queries(s3middleware.DeleteQuery).
-				Handler(named(s3middleware.DeleteMultipleObjectsOperation, h.DeleteMultipleObjectsHandler))).
+				Queries("delete").
+				Handler(named("DeleteMultipleObjects", h.DeleteMultipleObjectsHandler))).
 			// todo consider add filter to match header for defaultHandler:  hdrContentType, "multipart/form-data*"
-			DefaultHandler(named(s3middleware.PostObjectOperation, h.PostObject)))
+			DefaultHandler(named("PostObject", h.PostObject)))
 	})
 
 	// DELETE method handlers
 	bktRouter.Group(func(r chi.Router) {
 		r.Method(http.MethodDelete, "/", NewHandlerFilter().
 			Add(NewFilter().
-				Queries(s3middleware.CorsQuery).
-				Handler(named(s3middleware.DeleteBucketCorsOperation, h.DeleteBucketCorsHandler))).
+				Queries("cors").
+				Handler(named("DeleteBucketCors", h.DeleteBucketCorsHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.WebsiteQuery).
-				Handler(named(s3middleware.DeleteBucketWebsiteOperation, h.DeleteBucketWebsiteHandler))).
+				Queries("website").
+				Handler(named("DeleteBucketWebsite", h.DeleteBucketWebsiteHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.TaggingQuery).
-				Handler(named(s3middleware.DeleteBucketTaggingOperation, h.DeleteBucketTaggingHandler))).
+				Queries("tagging").
+				Handler(named("DeleteBucketTagging", h.DeleteBucketTaggingHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.PolicyQuery).
-				Handler(named(s3middleware.DeleteBucketPolicyOperation, h.DeleteBucketPolicyHandler))).
+				Queries("policy").
+				Handler(named("PutBucketPolicy", h.PutBucketPolicyHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.LifecycleQuery).
-				Handler(named(s3middleware.PutBucketLifecycleOperation, h.PutBucketLifecycleHandler))).
+				Queries("lifecycle").
+				Handler(named("PutBucketLifecycle", h.PutBucketLifecycleHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.EncryptionQuery).
-				Handler(named(s3middleware.DeleteBucketEncryptionOperation, h.DeleteBucketEncryptionHandler))).
-			DefaultHandler(named(s3middleware.DeleteBucketOperation, h.DeleteBucketHandler)))
+				Queries("encryption").
+				Handler(named("DeleteBucketEncryption", h.DeleteBucketEncryptionHandler))).
+			DefaultHandler(named("DeleteBucket", h.DeleteBucketHandler)))
 	})
 
 	attachErrorHandler(bktRouter)
@@ -343,30 +304,30 @@ func objectRouter(h Handler, l *zap.Logger) chi.Router {
 	objRouter := chi.NewRouter()
 	objRouter.Use(s3middleware.AddObjectName(l))
 
-	objRouter.Head("/*", named(s3middleware.HeadObjectOperation, h.HeadObjectHandler))
+	objRouter.Head("/*", named("HeadObject", h.HeadObjectHandler))
 
 	// GET method handlers
 	objRouter.Group(func(r chi.Router) {
 		r.Method(http.MethodGet, "/*", NewHandlerFilter().
 			Add(NewFilter().
-				Queries(s3middleware.UploadIDQuery).
-				Handler(named(s3middleware.ListPartsOperation, h.ListPartsHandler))).
+				Queries("uploadId").
+				Handler(named("ListParts", h.ListPartsHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.ACLQuery).
-				Handler(named(s3middleware.GetObjectACLOperation, h.GetObjectACLHandler))).
+				Queries("acl").
+				Handler(named("GetObjectACL", h.GetObjectACLHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.TaggingQuery).
-				Handler(named(s3middleware.GetObjectTaggingOperation, h.GetObjectTaggingHandler))).
+				Queries("tagging").
+				Handler(named("GetObjectTagging", h.GetObjectTaggingHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.RetentionQuery).
-				Handler(named(s3middleware.GetObjectRetentionOperation, h.GetObjectRetentionHandler))).
+				Queries("retention").
+				Handler(named("GetObjectRetention", h.GetObjectRetentionHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.LegalHoldQuery).
-				Handler(named(s3middleware.GetObjectLegalHoldOperation, h.GetObjectLegalHoldHandler))).
+				Queries("legal-hold").
+				Handler(named("GetObjectLegalHold", h.GetObjectLegalHoldHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.AttributesQuery).
-				Handler(named(s3middleware.GetObjectAttributesOperation, h.GetObjectAttributesHandler))).
-			DefaultHandler(named(s3middleware.GetObjectOperation, h.GetObjectHandler)))
+				Queries("attributes").
+				Handler(named("GetObjectAttributes", h.GetObjectAttributesHandler))).
+			DefaultHandler(named("GetObject", h.GetObjectHandler)))
 	})
 
 	// PUT method handlers
@@ -374,51 +335,51 @@ func objectRouter(h Handler, l *zap.Logger) chi.Router {
 		r.Method(http.MethodPut, "/*", NewHandlerFilter().
 			Add(NewFilter().
 				Headers(AmzCopySource).
-				Queries(s3middleware.PartNumberQuery, s3middleware.UploadIDQuery).
-				Handler(named(s3middleware.UploadPartCopyOperation, h.UploadPartCopy))).
+				Queries("partNumber", "uploadId").
+				Handler(named("UploadPartCopy", h.UploadPartCopy))).
 			Add(NewFilter().
-				Queries(s3middleware.PartNumberQuery, s3middleware.UploadIDQuery).
-				Handler(named(s3middleware.UploadPartOperation, h.UploadPartHandler))).
+				Queries("partNumber", "uploadId").
+				Handler(named("UploadPart", h.UploadPartHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.ACLQuery).
-				Handler(named(s3middleware.PutObjectACLOperation, h.PutObjectACLHandler))).
+				Queries("acl").
+				Handler(named("PutObjectACL", h.PutObjectACLHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.TaggingQuery).
-				Handler(named(s3middleware.PutObjectTaggingOperation, h.PutObjectTaggingHandler))).
+				Queries("tagging").
+				Handler(named("PutObjectTagging", h.PutObjectTaggingHandler))).
 			Add(NewFilter().
 				Headers(AmzCopySource).
-				Handler(named(s3middleware.CopyObjectOperation, h.CopyObjectHandler))).
+				Handler(named("CopyObject", h.CopyObjectHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.RetentionQuery).
-				Handler(named(s3middleware.PutObjectRetentionOperation, h.PutObjectRetentionHandler))).
+				Queries("retention").
+				Handler(named("PutObjectRetention", h.PutObjectRetentionHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.LegalHoldQuery).
-				Handler(named(s3middleware.PutObjectLegalHoldOperation, h.PutObjectLegalHoldHandler))).
-			DefaultHandler(named(s3middleware.PutObjectOperation, h.PutObjectHandler)))
+				Queries("legal-hold").
+				Handler(named("PutObjectLegalHold", h.PutObjectLegalHoldHandler))).
+			DefaultHandler(named("PutObject", h.PutObjectHandler)))
 	})
 
 	// POST method handlers
 	objRouter.Group(func(r chi.Router) {
 		r.Method(http.MethodPost, "/*", NewHandlerFilter().
 			Add(NewFilter().
-				Queries(s3middleware.UploadIDQuery).
-				Handler(named(s3middleware.CompleteMultipartUploadOperation, h.CompleteMultipartUploadHandler))).
+				Queries("uploadId").
+				Handler(named("CompleteMultipartUpload", h.CompleteMultipartUploadHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.UploadsQuery).
-				Handler(named(s3middleware.CreateMultipartUploadOperation, h.CreateMultipartUploadHandler))).
-			DefaultHandler(named(s3middleware.SelectObjectContentOperation, h.SelectObjectContentHandler)))
+				Queries("uploads").
+				Handler(named("CreateMultipartUpload", h.CreateMultipartUploadHandler))).
+			DefaultHandler(named("SelectObjectContent", h.SelectObjectContentHandler)))
 	})
 
 	// DELETE method handlers
 	objRouter.Group(func(r chi.Router) {
 		r.Method(http.MethodDelete, "/*", NewHandlerFilter().
 			Add(NewFilter().
-				Queries(s3middleware.UploadIDQuery).
-				Handler(named(s3middleware.AbortMultipartUploadOperation, h.AbortMultipartUploadHandler))).
+				Queries("uploadId").
+				Handler(named("AbortMultipartUpload", h.AbortMultipartUploadHandler))).
 			Add(NewFilter().
-				Queries(s3middleware.TaggingQuery).
-				Handler(named(s3middleware.DeleteObjectTaggingOperation, h.DeleteObjectTaggingHandler))).
-			DefaultHandler(named(s3middleware.DeleteObjectOperation, h.DeleteObjectHandler)))
+				Queries("tagging").
+				Handler(named("DeleteObjectTagging", h.DeleteObjectTaggingHandler))).
+			DefaultHandler(named("DeleteObject", h.DeleteObjectHandler)))
 	})
 
 	attachErrorHandler(objRouter)

api/router_mock_test.go

@@ -6,34 +6,17 @@ import (
 	"net/http"
 	"testing"
 
+	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/auth"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/data"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/middleware"
 	"github.com/stretchr/testify/require"
 )
 
-const FrostfsNamespaceHeader = "X-Frostfs-Namespace"
-
 type centerMock struct {
 }
 
-func (c *centerMock) Authenticate(*http.Request) (*middleware.Box, error) {
-	return &middleware.Box{}, nil
-}
-
-type middlewareSettingsMock struct {
-	denyByDefault bool
-}
-
-func (r *middlewareSettingsMock) NamespaceHeader() string {
-	return FrostfsNamespaceHeader
-}
-
-func (r *middlewareSettingsMock) ResolveNamespaceAlias(ns string) string {
-	return ns
-}
-
-func (r *middlewareSettingsMock) PolicyDenyByDefault() bool {
-	return r.denyByDefault
+func (c *centerMock) Authenticate(*http.Request) (*auth.Box, error) {
+	return &auth.Box{}, nil
 }
 
 type handlerMock struct {
@@ -117,7 +100,7 @@ func (h *handlerMock) PutObjectLegalHoldHandler(http.ResponseWriter, *http.Reque
 
 func (h *handlerMock) PutObjectHandler(w http.ResponseWriter, r *http.Request) {
 	res := &handlerResult{
-		Method:  middleware.PutObjectOperation,
+		Method:  "PutObject",
 		ReqInfo: middleware.GetReqInfo(r.Context()),
 	}
 
@@ -302,13 +285,9 @@ func (h *handlerMock) CreateBucketHandler(http.ResponseWriter, *http.Request) {
 	panic("implement me")
 }
 
-func (h *handlerMock) HeadBucketHandler(w http.ResponseWriter, r *http.Request) {
-	res := &handlerResult{
-		Method:  middleware.HeadBucketOperation,
-		ReqInfo: middleware.GetReqInfo(r.Context()),
-	}
-
-	h.writeResponse(w, res)
+func (h *handlerMock) HeadBucketHandler(http.ResponseWriter, *http.Request) {
+	//TODO implement me
+	panic("implement me")
 }
 
 func (h *handlerMock) PostObject(http.ResponseWriter, *http.Request) {
@@ -341,13 +320,9 @@ func (h *handlerMock) DeleteBucketHandler(http.ResponseWriter, *http.Request) {
 	panic("implement me")
 }
 
-func (h *handlerMock) ListBucketsHandler(w http.ResponseWriter, r *http.Request) {
-	res := &handlerResult{
-		Method:  middleware.ListBucketsOperation,
-		ReqInfo: middleware.GetReqInfo(r.Context()),
-	}
-
-	h.writeResponse(w, res)
+func (h *handlerMock) ListBucketsHandler(http.ResponseWriter, *http.Request) {
+	//TODO implement me
+	panic("implement me")
 }
 
 func (h *handlerMock) Preflight(http.ResponseWriter, *http.Request) {

api/router_test.go

@@ -2,7 +2,6 @@ package api
 
 import (
 	"encoding/json"
-	"encoding/xml"
 	"fmt"
 	"io"
 	"net/http"
@@ -11,56 +10,13 @@ import (
 	"testing"
 	"time"
 
-	apiErrors "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
-	s3middleware "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/middleware"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/metrics"
-	engineiam "git.frostfs.info/TrueCloudLab/policy-engine/iam"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine/inmemory"
-	"git.frostfs.info/TrueCloudLab/policy-engine/schema/s3"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/zap/zaptest"
 )
 
-type routerMock struct {
-	router             *chi.Mux
-	cfg                Config
-	middlewareSettings *middlewareSettingsMock
-	policyChecker      engine.LocalOverrideEngine
-}
-
-func (m *routerMock) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	m.router.ServeHTTP(w, r)
-}
-
-func prepareRouter(t *testing.T) *routerMock {
-	middlewareSettings := &middlewareSettingsMock{}
-	policyChecker := inmemory.NewInMemoryLocalOverrides()
-
-	cfg := Config{
-		Throttle: middleware.ThrottleOpts{
-			Limit:          10,
-			BacklogTimeout: 30 * time.Second,
-		},
-		Handler:            &handlerMock{t: t},
-		Center:             &centerMock{},
-		Log:                zaptest.NewLogger(t),
-		Metrics:            &metrics.AppMetrics{},
-		MiddlewareSettings: middlewareSettings,
-		PolicyChecker:      policyChecker,
-		Domains:            []string{"domain1", "domain2"},
-	}
-	return &routerMock{
-		router:             NewRouter(cfg),
-		cfg:                cfg,
-		middlewareSettings: middlewareSettings,
-		policyChecker:      policyChecker,
-	}
-}
-
 func TestRouterUploadPart(t *testing.T) {
 	chiRouter := prepareRouter(t)
 
@@ -155,102 +111,20 @@ func TestRouterObjectEscaping(t *testing.T) {
 	}
 }
 
-func TestPolicyChecker(t *testing.T) {
-	chiRouter := prepareRouter(t)
-	namespace := "custom-ns"
-	bktName, objName := "bucket", "object"
-	target := fmt.Sprintf("/%s/%s", bktName, objName)
-
-	ruleChain := &chain.Chain{
-		ID: chain.ID("id"),
-		Rules: []chain.Rule{{
-			Status:    chain.AccessDenied,
-			Actions:   chain.Actions{Names: []string{"*"}},
-			Resources: chain.Resources{Names: []string{fmt.Sprintf(s3.ResourceFormatS3BucketObjects, bktName)}},
-		}},
+func prepareRouter(t *testing.T) *chi.Mux {
+	throttleOps := middleware.ThrottleOpts{
+		Limit:          10,
+		BacklogTimeout: 30 * time.Second,
 	}
 
-	_, _, err := chiRouter.policyChecker.MorphRuleChainStorage().AddMorphRuleChain(chain.S3, engine.NamespaceTarget(namespace), ruleChain)
-	require.NoError(t, err)
+	handleMock := &handlerMock{t: t}
+	cntrMock := &centerMock{}
+	log := zaptest.NewLogger(t)
+	metric := &metrics.AppMetrics{}
 
-	// check we can access 'bucket' in default namespace
-	w, r := httptest.NewRecorder(), httptest.NewRequest(http.MethodPut, target, nil)
-	chiRouter.ServeHTTP(w, r)
-	resp := readResponse(t, w)
-	require.Equal(t, s3middleware.PutObjectOperation, resp.Method)
-
-	// check we can access 'other-bucket' in custom namespace
-	w, r = httptest.NewRecorder(), httptest.NewRequest(http.MethodPut, "/other-bucket/object", nil)
-	r.Header.Set(FrostfsNamespaceHeader, namespace)
-	chiRouter.ServeHTTP(w, r)
-	resp = readResponse(t, w)
-	require.Equal(t, s3middleware.PutObjectOperation, resp.Method)
-
-	// check we cannot access 'bucket' in custom namespace
-	w, r = httptest.NewRecorder(), httptest.NewRequest(http.MethodPut, target, nil)
-	r.Header.Set(FrostfsNamespaceHeader, namespace)
-	chiRouter.ServeHTTP(w, r)
-	assertAPIError(t, w, apiErrors.ErrAccessDenied)
-}
-
-func TestPolicyCheckerReqTypeDetermination(t *testing.T) {
-	chiRouter := prepareRouter(t)
-	bktName, objName := "bucket", "object"
-
-	policy := engineiam.Policy{
-		Statement: []engineiam.Statement{{
-			Principal: map[engineiam.PrincipalType][]string{engineiam.Wildcard: {}},
-			Effect:    engineiam.AllowEffect,
-			Action:    engineiam.Action{"s3:*"},
-			Resource:  engineiam.Resource{fmt.Sprintf(s3.ResourceFormatS3All)},
-		}},
-	}
-
-	ruleChain, err := engineiam.ConvertToS3Chain(policy, nil)
-	require.NoError(t, err)
-
-	_, _, err = chiRouter.policyChecker.MorphRuleChainStorage().AddMorphRuleChain(chain.S3, engine.NamespaceTarget(""), ruleChain)
-	require.NoError(t, err)
-
-	chiRouter.middlewareSettings.denyByDefault = true
-	t.Run("can list buckets", func(t *testing.T) {
-		w, r := httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, "/", nil)
-		chiRouter.ServeHTTP(w, r)
-		resp := readResponse(t, w)
-		require.Equal(t, s3middleware.ListBucketsOperation, resp.Method)
-	})
-
-	t.Run("can head 'bucket'", func(t *testing.T) {
-		w, r := httptest.NewRecorder(), httptest.NewRequest(http.MethodHead, "/"+bktName, nil)
-		chiRouter.ServeHTTP(w, r)
-		resp := readResponse(t, w)
-		require.Equal(t, s3middleware.HeadBucketOperation, resp.Method)
-	})
-
-	t.Run("can put object into 'bucket'", func(t *testing.T) {
-		w, r := httptest.NewRecorder(), httptest.NewRequest(http.MethodPut, fmt.Sprintf("/%s/%s", bktName, objName), nil)
-		chiRouter.ServeHTTP(w, r)
-		resp := readResponse(t, w)
-		require.Equal(t, s3middleware.PutObjectOperation, resp.Method)
-	})
-}
-
-func TestDefaultBehaviorPolicyChecker(t *testing.T) {
-	chiRouter := prepareRouter(t)
-	bktName, objName := "bucket", "object"
-	target := fmt.Sprintf("/%s/%s", bktName, objName)
-
-	// check we can access bucket if rules not found
-	w, r := httptest.NewRecorder(), httptest.NewRequest(http.MethodPut, target, nil)
-	chiRouter.ServeHTTP(w, r)
-	resp := readResponse(t, w)
-	require.Equal(t, s3middleware.PutObjectOperation, resp.Method)
-
-	// check we cannot access if rules not found when settings is enabled
-	chiRouter.middlewareSettings.denyByDefault = true
-	w, r = httptest.NewRecorder(), httptest.NewRequest(http.MethodPut, target, nil)
-	chiRouter.ServeHTTP(w, r)
-	assertAPIError(t, w, apiErrors.ErrAccessDenied)
+	chiRouter := chi.NewRouter()
+	AttachChi(chiRouter, nil, throttleOps, handleMock, cntrMock, log, metric)
+	return chiRouter
 }
 
 func readResponse(t *testing.T, w *httptest.ResponseRecorder) handlerResult {
@@ -263,18 +137,3 @@ func readResponse(t *testing.T, w *httptest.ResponseRecorder) handlerResult {
 	require.NoErrorf(t, err, "actual body: '%s'", string(resData))
 	return res
 }
-
-func assertAPIError(t *testing.T, w *httptest.ResponseRecorder, expectedErrorCode apiErrors.ErrorCode) {
-	actualErrorResponse := &s3middleware.ErrorResponse{}
-	err := xml.NewDecoder(w.Result().Body).Decode(actualErrorResponse)
-	require.NoError(t, err)
-
-	expectedError := apiErrors.GetAPIError(expectedErrorCode)
-
-	require.Equal(t, expectedError.HTTPStatusCode, w.Code)
-	require.Equal(t, expectedError.Code, actualErrorResponse.Code)
-
-	if expectedError.ErrCode != apiErrors.ErrInternalError {
-		require.Contains(t, actualErrorResponse.Message, expectedError.Description)
-	}
-}

authmate/authmate.go

@@ -22,7 +22,6 @@ import (
 	frostfsecdsa "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/crypto/ecdsa"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/eacl"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/netmap"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/session"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
@@ -82,11 +81,6 @@ type FrostFS interface {
 	TimeToEpoch(context.Context, time.Time) (uint64, uint64, error)
 }
 
-// FrostFSID represents interface to interact with frostfsid contract.
-type FrostFSID interface {
-	RegisterPublicKey(ns string, key *keys.PublicKey) error
-}
-
 // Agent contains client communicating with FrostFS and logger.
 type Agent struct {
 	frostFS FrostFS
@@ -114,16 +108,14 @@ type (
 		Lifetime              time.Duration
 		AwsCliCredentialsFile string
 		ContainerPolicies     ContainerPolicies
-		CustomAttributes      []object.Attribute
 	}
 
 	// UpdateSecretOptions contains options for passing to Agent.UpdateSecret method.
 	UpdateSecretOptions struct {
-		FrostFSKey       *keys.PrivateKey
-		GatesPublicKeys  []*keys.PublicKey
-		Address          oid.Address
-		GatePrivateKey   *keys.PrivateKey
-		CustomAttributes []object.Attribute
+		FrostFSKey      *keys.PrivateKey
+		GatesPublicKeys []*keys.PublicKey
+		Address         oid.Address
+		GatePrivateKey  *keys.PrivateKey
 	}
 
 	tokenUpdateOptions struct {
@@ -279,23 +271,9 @@ func (a *Agent) IssueSecret(ctx context.Context, w io.Writer, options *IssueSecr
 	a.log.Info(logs.StoreBearerTokenIntoFrostFS,
 		zap.Stringer("owner_tkn", idOwner))
 
-	cfg := tokens.Config{
-		FrostFS:     a.frostFS,
-		Key:         secrets.EphemeralKey,
-		CacheConfig: cache.DefaultAccessBoxConfig(a.log),
-	}
+	creds := tokens.New(a.frostFS, secrets.EphemeralKey, cache.DefaultAccessBoxConfig(a.log))
 
-	creds := tokens.New(cfg)
-
-	prm := tokens.CredentialsParam{
-		OwnerID:          idOwner,
-		AccessBox:        box,
-		Expiration:       lifetime.Exp,
-		Keys:             options.GatesPublicKeys,
-		CustomAttributes: options.CustomAttributes,
-	}
-
-	addr, err := creds.Put(ctx, id, prm)
+	addr, err := creds.Put(ctx, id, idOwner, box, lifetime.Exp, options.GatesPublicKeys...)
 	if err != nil {
 		return fmt.Errorf("failed to put creds: %w", err)
 	}
@@ -336,13 +314,7 @@ func (a *Agent) IssueSecret(ctx context.Context, w io.Writer, options *IssueSecr
 
 // UpdateSecret updates an auth token (change list of gates that can use credential), puts new cred version to the FrostFS network and writes to io.Writer a result.
 func (a *Agent) UpdateSecret(ctx context.Context, w io.Writer, options *UpdateSecretOptions) error {
-	cfg := tokens.Config{
-		FrostFS:     a.frostFS,
-		Key:         options.GatePrivateKey,
-		CacheConfig: cache.DefaultAccessBoxConfig(a.log),
-	}
-
-	creds := tokens.New(cfg)
+	creds := tokens.New(a.frostFS, options.GatePrivateKey, cache.DefaultAccessBoxConfig(a.log))
 
 	box, err := creds.GetBox(ctx, options.Address)
 	if err != nil {
@@ -377,16 +349,8 @@ func (a *Agent) UpdateSecret(ctx context.Context, w io.Writer, options *UpdateSe
 	a.log.Info(logs.UpdateAccessCredObjectIntoFrostFS,
 		zap.Stringer("owner_tkn", idOwner))
 
-	prm := tokens.CredentialsParam{
-		OwnerID:          idOwner,
-		AccessBox:        updatedBox,
-		Expiration:       lifetime.Exp,
-		Keys:             options.GatesPublicKeys,
-		CustomAttributes: options.CustomAttributes,
-	}
-
 	oldAddr := options.Address
-	addr, err := creds.Update(ctx, oldAddr, prm)
+	addr, err := creds.Update(ctx, oldAddr, idOwner, updatedBox, lifetime.Exp, options.GatesPublicKeys...)
 	if err != nil {
 		return fmt.Errorf("failed to update creds: %w", err)
 	}
@@ -418,13 +382,7 @@ func getLifetimeFromGateData(gateData *accessbox.GateData) lifetimeOptions {
 // ObtainSecret receives an existing secret access key from FrostFS and
 // writes to io.Writer the secret access key.
 func (a *Agent) ObtainSecret(ctx context.Context, w io.Writer, options *ObtainSecretOptions) error {
-	cfg := tokens.Config{
-		FrostFS:     a.frostFS,
-		Key:         options.GatePrivateKey,
-		CacheConfig: cache.DefaultAccessBoxConfig(a.log),
-	}
-
-	bearerCreds := tokens.New(cfg)
+	bearerCreds := tokens.New(a.frostFS, options.GatePrivateKey, cache.DefaultAccessBoxConfig(a.log))
 
 	var addr oid.Address
 	if err := addr.DecodeString(options.SecretAddress); err != nil {

cmd/s3-authmate/modules/errors.go

@@ -12,10 +12,6 @@ type (
 	businessLogicError struct {
 		err error
 	}
-
-	frostFSIDInitError struct {
-		err error
-	}
 )
 
 func wrapPreparationError(e error) error {
@@ -42,14 +38,6 @@ func (e businessLogicError) Error() string {
 	return e.err.Error()
 }
 
-func wrapFrostFSIDInitError(e error) error {
-	return frostFSIDInitError{e}
-}
-
-func (e frostFSIDInitError) Error() string {
-	return e.err.Error()
-}
-
 // ExitCode picks corresponding error code depending on the type of error provided.
 // Returns 1 if error type is unknown.
 func ExitCode(e error) int {
@@ -60,8 +48,6 @@ func ExitCode(e error) int {
 		return 3
 	case businessLogicError:
 		return 4
-	case frostFSIDInitError:
-		return 4
 	}
 	return 1
 }

cmd/s3-authmate/modules/issue-secret.go

@@ -8,7 +8,6 @@ import (
 	"time"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/authmate"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs/frostfsid"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/wallet"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
@@ -17,12 +16,11 @@ import (
 )
 
 var issueSecretCmd = &cobra.Command{
-	Use:   "issue-secret",
-	Short: "Issue a secret in FrostFS network",
-	Long:  "Creates new s3 credentials to use with frostfs-s3-gw",
-	Example: `frostfs-s3-authmate issue-secret --wallet wallet.json --peer s01.frostfs.devenv:8080 --gate-public-key 031a6c6fbbdf02ca351745fa86b9ba5a9452d785ac4f7fc2b7548ca2a46c4fcf4a
-frostfs-s3-authmate issue-secret --wallet wallet.json --peer s01.frostfs.devenv:8080 --gate-public-key 031a6c6fbbdf02ca351745fa86b9ba5a9452d785ac4f7fc2b7548ca2a46c4fcf4a --attributes LOGIN=NUUb82KR2JrVByHs2YSKgtK29gKnF5q6Vt`,
-	RunE: runIssueSecretCmd,
+	Use:     "issue-secret",
+	Short:   "Issue a secret in FrostFS network",
+	Long:    "Creates new s3 credentials to use with frostfs-s3-gw",
+	Example: `frostfs-s3-authmate issue-secret --wallet wallet.json --peer s01.frostfs.devenv:8080 --gate-public-key 031a6c6fbbdf02ca351745fa86b9ba5a9452d785ac4f7fc2b7548ca2a46c4fcf4a`,
+	RunE:    runIssueSecretCmd,
 }
 
 const (
@@ -39,11 +37,6 @@ const (
 	lifetimeFlag                 = "lifetime"
 	containerPolicyFlag          = "container-policy"
 	awsCLICredentialFlag         = "aws-cli-credentials"
-	frostfsIDFlag                = "frostfsid"
-	frostfsIDProxyFlag           = "frostfsid-proxy"
-	frostfsIDNamespaceFlag       = "frostfsid-namespace"
-	rpcEndpointFlag              = "rpc-endpoint"
-	attributesFlag               = "attributes"
 )
 
 const (
@@ -84,11 +77,6 @@ func initIssueSecretCmd() {
 	issueSecretCmd.Flags().Duration(poolHealthcheckTimeoutFlag, defaultPoolHealthcheckTimeout, "Timeout for request to node to decide if it is alive")
 	issueSecretCmd.Flags().Duration(poolRebalanceIntervalFlag, defaultPoolRebalanceInterval, "Interval for updating nodes health status")
 	issueSecretCmd.Flags().Duration(poolStreamTimeoutFlag, defaultPoolStreamTimeout, "Timeout for individual operation in streaming RPC")
-	issueSecretCmd.Flags().String(frostfsIDFlag, "", "FrostfsID contract hash (LE) or name in NNS to register public key in contract (rpc-endpoint flag also must be provided)")
-	issueSecretCmd.Flags().String(frostfsIDProxyFlag, "", "Proxy contract hash (LE) or name in NNS to use when interact with frostfsid contract")
-	issueSecretCmd.Flags().String(frostfsIDNamespaceFlag, "", "Namespace to register public key in frostfsid contract")
-	issueSecretCmd.Flags().String(rpcEndpointFlag, "", "NEO node RPC address")
-	issueSecretCmd.Flags().String(attributesFlag, "", "User attributes in form of Key1=Value1,Key2=Value2 (note: you cannot override system attributes)")
 
 	_ = issueSecretCmd.MarkFlagRequired(walletFlag)
 	_ = issueSecretCmd.MarkFlagRequired(peerFlag)
@@ -164,34 +152,6 @@ func runIssueSecretCmd(cmd *cobra.Command, _ []string) error {
 		return wrapFrostFSInitError(fmt.Errorf("failed to create FrostFS component: %s", err))
 	}
 
-	frostFSID := viper.GetString(frostfsIDFlag)
-	if frostFSID != "" {
-		rpcAddress := viper.GetString(rpcEndpointFlag)
-		if rpcAddress == "" {
-			return wrapPreparationError(fmt.Errorf("you can use '%s' flag only along with '%s'", frostfsIDFlag, rpcEndpointFlag))
-		}
-		cfg := frostfsid.Config{
-			RPCAddress:    rpcAddress,
-			Contract:      frostFSID,
-			ProxyContract: viper.GetString(frostfsIDProxyFlag),
-			Key:           key,
-		}
-
-		frostfsIDClient, err := createFrostFSID(ctx, log, cfg)
-		if err != nil {
-			return wrapFrostFSIDInitError(err)
-		}
-
-		if err = frostfsIDClient.RegisterPublicKey(viper.GetString(frostfsIDNamespaceFlag), key.PublicKey()); err != nil {
-			return wrapBusinessLogicError(fmt.Errorf("failed to register key in frostfsid: %w", err))
-		}
-	}
-
-	customAttrs, err := parseObjectAttrs(viper.GetString(attributesFlag))
-	if err != nil {
-		return wrapPreparationError(fmt.Errorf("failed to parse attributes: %s", err))
-	}
-
 	issueSecretOptions := &authmate.IssueSecretOptions{
 		Container: authmate.ContainerOptions{
 			ID:              cnrID,
@@ -207,7 +167,6 @@ func runIssueSecretCmd(cmd *cobra.Command, _ []string) error {
 		ContainerPolicies:     policies,
 		Lifetime:              lifetime,
 		AwsCliCredentialsFile: viper.GetString(awsCLICredentialFlag),
-		CustomAttributes:      customAttrs,
 	}
 
 	if err = authmate.New(log, frostFS).IssueSecret(ctx, os.Stdout, issueSecretOptions); err != nil {

cmd/s3-authmate/modules/update-secret.go

@@ -7,7 +7,6 @@ import (
 	"strings"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/authmate"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs/frostfsid"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/wallet"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
@@ -40,11 +39,6 @@ func initUpdateSecretCmd() {
 	updateSecretCmd.Flags().Duration(poolHealthcheckTimeoutFlag, defaultPoolHealthcheckTimeout, "Timeout for request to node to decide if it is alive")
 	updateSecretCmd.Flags().Duration(poolRebalanceIntervalFlag, defaultPoolRebalanceInterval, "Interval for updating nodes health status")
 	updateSecretCmd.Flags().Duration(poolStreamTimeoutFlag, defaultPoolStreamTimeout, "Timeout for individual operation in streaming RPC")
-	updateSecretCmd.Flags().String(frostfsIDFlag, "", "FrostfsID contract hash (LE) or name in NNS to register public key in contract (rpc-endpoint flag also must be provided)")
-	updateSecretCmd.Flags().String(frostfsIDProxyFlag, "", "Proxy contract hash (LE) or name in NNS to use when interact with frostfsid contract")
-	updateSecretCmd.Flags().String(frostfsIDNamespaceFlag, "", "Namespace to register public key in frostfsid contract")
-	updateSecretCmd.Flags().String(rpcEndpointFlag, "", "NEO node RPC address")
-	updateSecretCmd.Flags().String(attributesFlag, "", "User attributes in form of Key1=Value1,Key2=Value2 (note: you cannot override system attributes)")
 
 	_ = updateSecretCmd.MarkFlagRequired(walletFlag)
 	_ = updateSecretCmd.MarkFlagRequired(peerFlag)
@@ -100,40 +94,11 @@ func runUpdateSecretCmd(cmd *cobra.Command, _ []string) error {
 		return wrapFrostFSInitError(fmt.Errorf("failed to create FrostFS component: %s", err))
 	}
 
-	frostFSID := viper.GetString(frostfsIDFlag)
-	if frostFSID != "" {
-		rpcAddress := viper.GetString(rpcEndpointFlag)
-		if rpcAddress == "" {
-			return wrapPreparationError(fmt.Errorf("you can use '%s' flag only along with '%s'", frostfsIDFlag, rpcEndpointFlag))
-		}
-		cfg := frostfsid.Config{
-			RPCAddress:    rpcAddress,
-			Contract:      frostFSID,
-			ProxyContract: viper.GetString(frostfsIDProxyFlag),
-			Key:           key,
-		}
-
-		frostfsIDClient, err := createFrostFSID(ctx, log, cfg)
-		if err != nil {
-			return wrapFrostFSIDInitError(err)
-		}
-
-		if err = frostfsIDClient.RegisterPublicKey(viper.GetString(frostfsIDNamespaceFlag), key.PublicKey()); err != nil {
-			return wrapBusinessLogicError(fmt.Errorf("failed to register key in frostfsid: %w", err))
-		}
-	}
-
-	customAttrs, err := parseObjectAttrs(viper.GetString(attributesFlag))
-	if err != nil {
-		return wrapPreparationError(fmt.Errorf("failed to parse attributes: %s", err))
-	}
-
 	updateSecretOptions := &authmate.UpdateSecretOptions{
-		Address:          accessBoxAddress,
-		FrostFSKey:       key,
-		GatesPublicKeys:  gatesPublicKeys,
-		GatePrivateKey:   gateKey,
-		CustomAttributes: customAttrs,
+		Address:         accessBoxAddress,
+		FrostFSKey:      key,
+		GatesPublicKeys: gatesPublicKeys,
+		GatePrivateKey:  gateKey,
 	}
 
 	if err = authmate.New(log, frostFS).UpdateSecret(ctx, os.Stdout, updateSecretOptions); err != nil {

cmd/s3-authmate/modules/utils.go

@@ -5,15 +5,12 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
-	"strings"
 	"time"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/authmate"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs/frostfsid"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/pool"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"github.com/spf13/viper"
@@ -144,34 +141,3 @@ func getLogger() *zap.Logger {
 
 	return log
 }
-
-func createFrostFSID(ctx context.Context, log *zap.Logger, cfg frostfsid.Config) (authmate.FrostFSID, error) {
-	log.Debug(logs.PrepareFrostfsIDClient)
-
-	cli, err := frostfsid.New(ctx, cfg)
-	if err != nil {
-		return nil, fmt.Errorf("create frostfsid client: %w", err)
-	}
-
-	return cli, nil
-}
-
-func parseObjectAttrs(attributes string) ([]object.Attribute, error) {
-	if len(attributes) == 0 {
-		return nil, nil
-	}
-
-	rawAttrs := strings.Split(attributes, ",")
-
-	attrs := make([]object.Attribute, len(rawAttrs))
-	for i := range rawAttrs {
-		k, v, found := strings.Cut(rawAttrs[i], "=")
-		if !found {
-			return nil, fmt.Errorf("invalid attribute format: %s", rawAttrs[i])
-		}
-		attrs[i].SetKey(k)
-		attrs[i].SetValue(v)
-	}
-
-	return attrs, nil
-}

cmd/s3-gw/app.go

@@ -4,10 +4,8 @@ import (
 	"context"
 	"encoding/hex"
 	"encoding/xml"
-	"errors"
 	"fmt"
 	"io"
-	"net"
 	"net/http"
 	"os"
 	"os/signal"
@@ -16,7 +14,6 @@ import (
 	"syscall"
 	"time"
 
-	v2container "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/container"
 	"git.frostfs.info/TrueCloudLab/frostfs-observability/tracing"
 	grpctracing "git.frostfs.info/TrueCloudLab/frostfs-observability/tracing/grpc"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api"
@@ -24,31 +21,24 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/cache"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/handler"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/layer"
-	s3middleware "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/middleware"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/notifications"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/resolver"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/creds/tokens"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs/frostfsid"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs/policy"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs/policy/contract"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs/services"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/version"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/wallet"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/metrics"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/pkg/service/control"
-	controlSvc "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/pkg/service/control/server"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/pkg/service/tree"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/netmap"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/pool"
 	treepool "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/pool/tree"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
+	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"github.com/spf13/viper"
 	"go.uber.org/zap"
-	"golang.org/x/exp/slices"
 	"google.golang.org/grpc"
 )
 
@@ -57,7 +47,7 @@ const awsDefaultNamespace = "http://s3.amazonaws.com/doc/2006-03-01/"
 type (
 	// App is the main application structure.
 	App struct {
-		ctr      s3middleware.Center
+		ctr      auth.Center
 		log      *zap.Logger
 		cfg      *viper.Viper
 		pool     *pool.Pool
@@ -67,14 +57,8 @@ type (
 		obj      layer.Client
 		api      api.Handler
 
-		frostfsid *frostfsid.FrostFSID
-
-		policyStorage *policy.Storage
-
 		servers []Server
 
-		controlAPI *grpc.Server
-
 		metrics        *metrics.AppMetrics
 		bucketResolver *resolver.BucketResolver
 		services       []*Service
@@ -85,25 +69,23 @@ type (
 	}
 
 	appSettings struct {
-		logLevel            zap.AtomicLevel
-		maxClient           maxClientsConfig
-		defaultMaxAge       int
-		notificatorEnabled  bool
-		resolveZoneList     []string
-		isResolveListAllow  bool // True if ResolveZoneList contains allowed zones
-		frostfsidValidation bool
+		logLevel           zap.AtomicLevel
+		maxClient          maxClientsConfig
+		defaultMaxAge      int
+		notificatorEnabled bool
+		resolveZoneList    []string
+		isResolveListAllow bool // True if ResolveZoneList contains allowed zones
 
 		mu                            sync.RWMutex
-		namespaces                    Namespaces
+		defaultPolicy                 netmap.PlacementPolicy
+		regionMap                     map[string]netmap.PlacementPolicy
+		copiesNumbers                 map[string][]uint32
+		defaultCopiesNumbers          []uint32
 		defaultXMLNS                  bool
 		bypassContentEncodingInChunks bool
 		clientCut                     bool
 		maxBufferSizeForPut           uint64
 		md5Enabled                    bool
-		namespaceHeader               string
-		defaultNamespaces             []string
-		authorizedControlAPIKeys      [][]byte
-		policyDenyByDefault           bool
 	}
 
 	maxClientsConfig struct {
@@ -120,15 +102,8 @@ type (
 func newApp(ctx context.Context, log *Logger, v *viper.Viper) *App {
 	objPool, treePool, key := getPools(ctx, log.logger, v)
 
-	cfg := tokens.Config{
-		FrostFS:                     frostfs.NewAuthmateFrostFS(objPool, key),
-		Key:                         key,
-		CacheConfig:                 getAccessBoxCacheConfig(v, log.logger),
-		RemovingCheckAfterDurations: fetchRemovingCheckInterval(v, log.logger),
-	}
-
 	// prepare auth center
-	ctr := auth.New(tokens.New(cfg), v.GetStringSlice(cfgAllowedAccessKeyIDPrefixes))
+	ctr := auth.New(frostfs.NewAuthmateFrostFS(objPool, key), key, v.GetStringSlice(cfgAllowedAccessKeyIDPrefixes), getAccessBoxCacheConfig(v, log.logger))
 
 	app := &App{
 		ctr:      ctr,
@@ -141,7 +116,7 @@ func newApp(ctx context.Context, log *Logger, v *viper.Viper) *App {
 		webDone: make(chan struct{}, 1),
 		wrkDone: make(chan struct{}, 1),
 
-		settings: newAppSettings(log, v, key),
+		settings: newAppSettings(log, v),
 	}
 
 	app.init(ctx)
@@ -151,11 +126,8 @@ func newApp(ctx context.Context, log *Logger, v *viper.Viper) *App {
 
 func (a *App) init(ctx context.Context) {
 	a.setRuntimeParameters()
-	a.initFrostfsID(ctx)
-	a.initPolicyStorage(ctx)
 	a.initAPI(ctx)
 	a.initMetrics()
-	a.initControlAPI()
 	a.initServers(ctx)
 	a.initTracing(ctx)
 }
@@ -173,7 +145,7 @@ func (a *App) initLayer(ctx context.Context) {
 	user.IDFromKey(&gateOwner, a.key.PrivateKey.PublicKey)
 
 	layerCfg := &layer.Config{
-		Cache: layer.NewCache(getCacheOptions(a.cfg, a.log)),
+		Caches: getCacheOptions(a.cfg, a.log),
 		AnonKey: layer.AnonymousKey{
 			Key: randomKey,
 		},
@@ -199,13 +171,13 @@ func (a *App) initLayer(ctx context.Context) {
 	}
 }
 
-func newAppSettings(log *Logger, v *viper.Viper, key *keys.PrivateKey) *appSettings {
+func newAppSettings(log *Logger, v *viper.Viper) *appSettings {
 	settings := &appSettings{
-		logLevel:            log.lvl,
-		maxClient:           newMaxClients(v),
-		defaultMaxAge:       fetchDefaultMaxAge(v, log.logger),
-		notificatorEnabled:  v.GetBool(cfgEnableNATS),
-		frostfsidValidation: v.GetBool(cfgFrostfsIDValidationEnabled),
+		logLevel:           log.lvl,
+		maxClient:          newMaxClients(v),
+		defaultXMLNS:       v.GetBool(cfgKludgeUseDefaultXMLNS),
+		defaultMaxAge:      fetchDefaultMaxAge(v, log.logger),
+		notificatorEnabled: v.GetBool(cfgEnableNATS),
 	}
 
 	settings.resolveZoneList = v.GetStringSlice(cfgResolveBucketAllow)
@@ -214,24 +186,15 @@ func newAppSettings(log *Logger, v *viper.Viper, key *keys.PrivateKey) *appSetti
 		settings.resolveZoneList = v.GetStringSlice(cfgResolveBucketDeny)
 	}
 
-	settings.update(v, log.logger, key)
+	settings.setBypassContentEncodingInChunks(v.GetBool(cfgKludgeBypassContentEncodingCheckInChunks))
+	settings.setClientCut(v.GetBool(cfgClientCut))
+	settings.initPlacementPolicy(log.logger, v)
+	settings.setBufferMaxSizeForPut(v.GetUint64(cfgBufferMaxSizeForPut))
+	settings.setMD5Enabled(v.GetBool(cfgMD5Enabled))
 
 	return settings
 }
 
-func (s *appSettings) update(v *viper.Viper, log *zap.Logger, key *keys.PrivateKey) {
-	s.setNamespaceHeader(v.GetString(cfgResolveNamespaceHeader)) // should be updated before placement policies
-	s.initPlacementPolicy(log, v)
-	s.useDefaultXMLNamespace(v.GetBool(cfgKludgeUseDefaultXMLNS))
-	s.setBypassContentEncodingInChunks(v.GetBool(cfgKludgeBypassContentEncodingCheckInChunks))
-	s.setClientCut(v.GetBool(cfgClientCut))
-	s.setBufferMaxSizeForPut(v.GetUint64(cfgBufferMaxSizeForPut))
-	s.setMD5Enabled(v.GetBool(cfgMD5Enabled))
-	s.setDefaultNamespaces(fetchDefaultNamespaces(log, v))
-	s.setAuthorizedControlAPIKeys(append(fetchAuthorizedKeys(log, v), key.PublicKey()))
-	s.setPolicyDenyByDefault(v.GetBool(cfgPolicyDenyByDefault))
-}
-
 func (s *appSettings) BypassContentEncodingInChunks() bool {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
@@ -269,40 +232,46 @@ func (s *appSettings) setBufferMaxSizeForPut(size uint64) {
 }
 
 func (s *appSettings) initPlacementPolicy(l *zap.Logger, v *viper.Viper) {
-	nsConfig := fetchNamespacesConfig(l, v)
+	defaultPolicy := fetchDefaultPolicy(l, v)
+	regionMap := fetchRegionMappingPolicies(l, v)
+	defaultCopies := fetchDefaultCopiesNumbers(l, v)
+	copiesNumbers := fetchCopiesNumbers(l, v)
 
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	s.namespaces = nsConfig.Namespaces
+	s.defaultPolicy = defaultPolicy
+	s.regionMap = regionMap
+	s.defaultCopiesNumbers = defaultCopies
+	s.copiesNumbers = copiesNumbers
 }
 
-func (s *appSettings) DefaultPlacementPolicy(namespace string) netmap.PlacementPolicy {
+func (s *appSettings) DefaultPlacementPolicy() netmap.PlacementPolicy {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	return s.namespaces[namespace].LocationConstraints[defaultConstraintName]
+	return s.defaultPolicy
 }
 
-func (s *appSettings) PlacementPolicy(namespace, constraint string) (netmap.PlacementPolicy, bool) {
+func (s *appSettings) PlacementPolicy(name string) (netmap.PlacementPolicy, bool) {
 	s.mu.RLock()
-	placementPolicy, ok := s.namespaces[namespace].LocationConstraints[constraint]
+	policy, ok := s.regionMap[name]
 	s.mu.RUnlock()
 
-	return placementPolicy, ok
+	return policy, ok
 }
 
-func (s *appSettings) CopiesNumbers(namespace, constraint string) ([]uint32, bool) {
+func (s *appSettings) CopiesNumbers(locationConstraint string) ([]uint32, bool) {
 	s.mu.RLock()
-	copiesNumbers, ok := s.namespaces[namespace].CopiesNumbers[constraint]
+	copiesNumbers, ok := s.copiesNumbers[locationConstraint]
 	s.mu.RUnlock()
 
 	return copiesNumbers, ok
 }
 
-func (s *appSettings) DefaultCopiesNumbers(namespace string) []uint32 {
+func (s *appSettings) DefaultCopiesNumbers() []uint32 {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	return s.namespaces[namespace].CopiesNumbers[defaultConstraintName]
+	return s.defaultCopiesNumbers
 }
 
 func (s *appSettings) NewXMLDecoder(r io.Reader) *xml.Decoder {
@@ -351,157 +320,32 @@ func (s *appSettings) setMD5Enabled(md5Enabled bool) {
 	s.mu.Unlock()
 }
 
-func (s *appSettings) NamespaceHeader() string {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	return s.namespaceHeader
-}
-
-func (s *appSettings) setNamespaceHeader(nsHeader string) {
-	s.mu.Lock()
-	s.namespaceHeader = nsHeader
-	s.mu.Unlock()
-}
-
-func (s *appSettings) FormContainerZone(ns string) (zone string, isDefault bool) {
-	if s.IsDefaultNamespace(ns) {
-		return v2container.SysAttributeZoneDefault, true
-	}
-
-	return ns + ".ns", false
-}
-
-func (s *appSettings) IsDefaultNamespace(ns string) bool {
-	s.mu.RLock()
-	namespaces := s.defaultNamespaces
-	s.mu.RUnlock()
-	return slices.Contains(namespaces, ns)
-}
-
-func (s *appSettings) setDefaultNamespaces(namespaces []string) {
-	s.mu.Lock()
-	s.defaultNamespaces = namespaces
-	s.mu.Unlock()
-}
-
-func (s *appSettings) FetchRawKeys() [][]byte {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	return s.authorizedControlAPIKeys
-}
-
-func (s *appSettings) setAuthorizedControlAPIKeys(keys keys.PublicKeys) {
-	rawPubs := make([][]byte, len(keys))
-	for i := range keys {
-		rawPubs[i] = keys[i].Bytes()
-	}
-
-	s.mu.Lock()
-	s.authorizedControlAPIKeys = rawPubs
-	s.mu.Unlock()
-}
-
-func (s *appSettings) ResolveNamespaceAlias(namespace string) string {
-	if s.IsDefaultNamespace(namespace) {
-		return defaultNamespace
-	}
-
-	return namespace
-}
-
-func (s *appSettings) PolicyDenyByDefault() bool {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	return s.policyDenyByDefault
-}
-
-func (s *appSettings) setPolicyDenyByDefault(policyDenyByDefault bool) {
-	s.mu.Lock()
-	s.policyDenyByDefault = policyDenyByDefault
-	s.mu.Unlock()
-}
-
 func (a *App) initAPI(ctx context.Context) {
 	a.initLayer(ctx)
 	a.initHandler()
 }
 
-func (a *App) initControlAPI() {
-	svc := controlSvc.New(
-		controlSvc.WithSettings(a.settings),
-		controlSvc.WithLogger(a.log),
-		controlSvc.WithChainStorage(a.policyStorage.LocalStorage()),
-	)
-
-	a.controlAPI = grpc.NewServer()
-
-	control.RegisterControlServiceServer(a.controlAPI, svc)
-}
-
 func (a *App) initMetrics() {
 	a.metrics = metrics.NewAppMetrics(a.log, frostfs.NewPoolStatistic(a.pool), a.cfg.GetBool(cfgPrometheusEnabled))
 	a.metrics.State().SetHealth(metrics.HealthStatusStarting)
 }
 
-func (a *App) initFrostfsID(ctx context.Context) {
-	var err error
-	a.frostfsid, err = frostfsid.New(ctx, frostfsid.Config{
-		RPCAddress:    a.cfg.GetString(cfgRPCEndpoint),
-		Contract:      a.cfg.GetString(cfgFrostfsIDContract),
-		ProxyContract: a.cfg.GetString(cfgProxyContract),
-		Key:           a.key,
-	})
-	if err != nil {
-		a.log.Fatal(logs.InitFrostfsIDContractFailed, zap.Error(err))
-	}
-}
-
-func (a *App) initPolicyStorage(ctx context.Context) {
-	var (
-		err            error
-		policyContract policy.Contract
-	)
-
-	if a.cfg.GetBool(cfgPolicyEnabled) {
-		policyContract, err = contract.New(ctx, contract.Config{
-			RPCAddress:    a.cfg.GetString(cfgRPCEndpoint),
-			Contract:      a.cfg.GetString(cfgPolicyContract),
-			ProxyContract: a.cfg.GetString(cfgProxyContract),
-			Key:           a.key,
-		})
-		if err != nil {
-			a.log.Fatal(logs.InitPolicyContractFailed, zap.Error(err))
-		}
-	} else {
-		policyContract = contract.NewInMemoryContract()
-	}
-
-	a.policyStorage = policy.NewStorage(policy.StorageConfig{
-		Contract: policyContract,
-		Cache:    cache.NewMorphPolicyCache(getMorphPolicyCacheConfig(a.cfg, a.log)),
-		Log:      a.log,
-	})
-}
-
 func (a *App) initResolver() {
 	var err error
-	a.bucketResolver, err = resolver.NewBucketResolver(a.getResolverOrder(), a.getResolverConfig())
+	a.bucketResolver, err = resolver.NewBucketResolver(a.getResolverConfig())
 	if err != nil {
 		a.log.Fatal(logs.FailedToCreateResolver, zap.Error(err))
 	}
 }
 
-func (a *App) getResolverConfig() *resolver.Config {
-	return &resolver.Config{
+func (a *App) getResolverConfig() ([]string, *resolver.Config) {
+	resolveCfg := &resolver.Config{
 		FrostFS:    frostfs.NewResolverFrostFS(a.pool),
 		RPCAddress: a.cfg.GetString(cfgRPCEndpoint),
-		Settings:   a.settings,
 	}
-}
 
-func (a *App) getResolverOrder() []string {
 	order := a.cfg.GetStringSlice(cfgResolveOrder)
-	if a.cfg.GetString(cfgRPCEndpoint) == "" {
+	if resolveCfg.RPCAddress == "" {
 		order = remove(order, resolver.NNSResolver)
 		a.log.Warn(logs.ResolverNNSWontBeUsedSinceRPCEndpointIsntProvided)
 	}
@@ -510,7 +354,7 @@ func (a *App) getResolverOrder() []string {
 		a.log.Info(logs.ContainerResolverWillBeDisabled)
 	}
 
-	return order
+	return order, resolveCfg
 }
 
 func (a *App) initTracing(ctx context.Context) {
@@ -595,8 +439,6 @@ func getPools(ctx context.Context, logger *zap.Logger, cfg *viper.Viper) (*pool.
 	prm.SetLogger(logger)
 	prmTree.SetLogger(logger)
 
-	prmTree.SetMaxRequestAttempts(cfg.GetInt(cfgTreePoolMaxAttempts))
-
 	var apiGRPCDialOpts []grpc.DialOption
 	var treeGRPCDialOpts []grpc.DialOption
 	if cfg.GetBool(cfgTracingEnabled) {
@@ -668,25 +510,13 @@ func (a *App) Serve(ctx context.Context) {
 	domains := a.cfg.GetStringSlice(cfgListenDomains)
 	a.log.Info(logs.FetchDomainsPrepareToUseAPI, zap.Strings("domains", domains))
 
-	cfg := api.Config{
-		Throttle: middleware.ThrottleOpts{
-			Limit:          a.settings.maxClient.count,
-			BacklogTimeout: a.settings.maxClient.deadline,
-		},
-		Handler: a.api,
-		Center:  a.ctr,
-		Log:     a.log,
-		Metrics: a.metrics,
-		Domains: domains,
-
-		MiddlewareSettings: a.settings,
-		PolicyChecker:      a.policyStorage,
-
-		FrostfsID:           a.frostfsid,
-		FrostFSIDValidation: a.settings.frostfsidValidation,
+	throttleOps := middleware.ThrottleOpts{
+		Limit:          a.settings.maxClient.count,
+		BacklogTimeout: a.settings.maxClient.deadline,
 	}
 
-	chiRouter := api.NewRouter(cfg)
+	chiRouter := chi.NewRouter()
+	api.AttachChi(chiRouter, domains, throttleOps, a.api, a.ctr, a.log, a.metrics)
 
 	// Use mux.Router as http.Handler
 	srv := new(http.Server)
@@ -710,16 +540,6 @@ func (a *App) Serve(ctx context.Context) {
 		}(i)
 	}
 
-	go func() {
-		address := a.cfg.GetString(cfgControlGRPCEndpoint)
-		a.log.Info(logs.StartingControlAPI, zap.String("address", address))
-		if listener, err := net.Listen("tcp", address); err != nil {
-			a.log.Fatal(logs.ListenAndServe, zap.Error(err))
-		} else if err = a.controlAPI.Serve(listener); err != nil {
-			a.log.Fatal(logs.ListenAndServe, zap.Error(err))
-		}
-	}()
-
 	sigs := make(chan os.Signal, 1)
 	signal.Notify(sigs, syscall.SIGHUP)
 
@@ -738,7 +558,6 @@ LOOP:
 
 	a.log.Info(logs.StoppingServer, zap.Error(srv.Shutdown(ctx)))
 
-	a.stopControlAPI()
 	a.metrics.Shutdown()
 	a.stopServices()
 	a.shutdownTracing()
@@ -750,25 +569,6 @@ func shutdownContext() (context.Context, context.CancelFunc) {
 	return context.WithTimeout(context.Background(), defaultShutdownTimeout)
 }
 
-func (a *App) stopControlAPI() {
-	ctx, cancel := shutdownContext()
-	defer cancel()
-
-	go func() {
-		a.controlAPI.GracefulStop()
-		cancel()
-	}()
-
-	<-ctx.Done()
-
-	if errors.Is(ctx.Err(), context.DeadlineExceeded) {
-		a.log.Info(logs.ControlAPICannotShutdownGracefully)
-		a.controlAPI.Stop()
-	}
-
-	a.log.Info(logs.ControlAPIServiceStopped)
-}
-
 func (a *App) configReload(ctx context.Context) {
 	a.log.Info(logs.SIGHUPConfigReloadStarted)
 
@@ -781,7 +581,7 @@ func (a *App) configReload(ctx context.Context) {
 		return
 	}
 
-	if err := a.bucketResolver.UpdateResolvers(a.getResolverOrder()); err != nil {
+	if err := a.bucketResolver.UpdateResolvers(a.getResolverConfig()); err != nil {
 		a.log.Warn(logs.FailedToReloadResolvers, zap.Error(err))
 	}
 
@@ -810,7 +610,13 @@ func (a *App) updateSettings() {
 		a.settings.logLevel.SetLevel(lvl)
 	}
 
-	a.settings.update(a.cfg, a.log, a.key)
+	a.settings.initPlacementPolicy(a.log, a.cfg)
+
+	a.settings.useDefaultXMLNamespace(a.cfg.GetBool(cfgKludgeUseDefaultXMLNS))
+	a.settings.setBypassContentEncodingInChunks(a.cfg.GetBool(cfgKludgeBypassContentEncodingCheckInChunks))
+	a.settings.setClientCut(a.cfg.GetBool(cfgClientCut))
+	a.settings.setBufferMaxSizeForPut(a.cfg.GetUint64(cfgBufferMaxSizeForPut))
+	a.settings.setMD5Enabled(a.cfg.GetBool(cfgMD5Enabled))
 }
 
 func (a *App) startServices() {
@@ -914,9 +720,6 @@ func getCacheOptions(v *viper.Viper, l *zap.Logger) *layer.CachesConfig {
 	cacheCfg.ObjectsList.Lifetime = fetchCacheLifetime(v, l, cfgListObjectsCacheLifetime, cacheCfg.ObjectsList.Lifetime)
 	cacheCfg.ObjectsList.Size = fetchCacheSize(v, l, cfgListObjectsCacheSize, cacheCfg.ObjectsList.Size)
 
-	cacheCfg.SessionList.Lifetime = fetchCacheLifetime(v, l, cfgSessionListCacheLifetime, cacheCfg.SessionList.Lifetime)
-	cacheCfg.SessionList.Size = fetchCacheSize(v, l, cfgSessionListCacheSize, cacheCfg.SessionList.Size)
-
 	cacheCfg.Buckets.Lifetime = fetchCacheLifetime(v, l, cfgBucketsCacheLifetime, cacheCfg.Buckets.Lifetime)
 	cacheCfg.Buckets.Size = fetchCacheSize(v, l, cfgBucketsCacheSize, cacheCfg.Buckets.Size)
 
@@ -941,26 +744,9 @@ func getAccessBoxCacheConfig(v *viper.Viper, l *zap.Logger) *cache.Config {
 	return cacheCfg
 }
 
-func getMorphPolicyCacheConfig(v *viper.Viper, l *zap.Logger) *cache.Config {
-	cacheCfg := cache.DefaultMorphPolicyConfig(l)
-
-	cacheCfg.Lifetime = fetchCacheLifetime(v, l, cfgMorphPolicyCacheLifetime, cacheCfg.Lifetime)
-	cacheCfg.Size = fetchCacheSize(v, l, cfgMorphPolicyCacheSize, cacheCfg.Size)
-
-	return cacheCfg
-}
-
 func (a *App) initHandler() {
-	var (
-		err   error
-		ffsid handler.FrostFSID
-	)
-
-	if a.frostfsid != nil {
-		ffsid = a.frostfsid
-	}
-
-	a.api, err = handler.New(a.log, a.obj, a.nc, a.settings, a.policyStorage, ffsid)
+	var err error
+	a.api, err = handler.New(a.log, a.obj, a.nc, a.settings)
 	if err != nil {
 		a.log.Fatal(logs.CouldNotInitializeAPIHandler, zap.Error(err))
 	}

cmd/s3-gw/app_settings.go

@@ -21,7 +21,6 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/netmap"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/pool"
 	"git.frostfs.info/TrueCloudLab/zapjournald"
-	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"github.com/spf13/pflag"
 	"github.com/spf13/viper"
 	"github.com/ssgreg/journald"
@@ -51,20 +50,9 @@ const (
 
 	defaultReadHeaderTimeout = 30 * time.Second
 	defaultIdleTimeout       = 30 * time.Second
-
-	defaultAccessBoxCacheRemovingCheckInterval = 5 * time.Minute
-
-	defaultNamespaceHeader = "X-Frostfs-Namespace"
-
-	defaultConstraintName = "default"
-
-	defaultNamespace = ""
 )
 
-var (
-	defaultCopiesNumbers     = []uint32{0}
-	defaultDefaultNamespaces = []string{"", "root"}
-)
+var defaultCopiesNumbers = []uint32{0}
 
 const ( // Settings.
 	// Logger.
@@ -84,10 +72,6 @@ const ( // Settings.
 	cfgTLSKeyFile  = "tls.key_file"
 	cfgTLSCertFile = "tls.cert_file"
 
-	// Control API.
-	cfgControlAuthorizedKeys = "control.authorized_keys"
-	cfgControlGRPCEndpoint   = "control.grpc.endpoint"
-
 	// Pool config.
 	cfgConnectTimeout     = "connect_timeout"
 	cfgStreamTimeout      = "stream_timeout"
@@ -100,8 +84,6 @@ const ( // Settings.
 	cfgObjectsCacheSize           = "cache.objects.size"
 	cfgListObjectsCacheLifetime   = "cache.list.lifetime"
 	cfgListObjectsCacheSize       = "cache.list.size"
-	cfgSessionListCacheLifetime   = "cache.list_session.lifetime"
-	cfgSessionListCacheSize       = "cache.list_session.size"
 	cfgBucketsCacheLifetime       = "cache.buckets.lifetime"
 	cfgBucketsCacheSize           = "cache.buckets.size"
 	cfgNamesCacheLifetime         = "cache.names.lifetime"
@@ -112,10 +94,6 @@ const ( // Settings.
 	cfgAccessBoxCacheSize         = "cache.accessbox.size"
 	cfgAccessControlCacheLifetime = "cache.accesscontrol.lifetime"
 	cfgAccessControlCacheSize     = "cache.accesscontrol.size"
-	cfgMorphPolicyCacheLifetime   = "cache.morph_policy.lifetime"
-	cfgMorphPolicyCacheSize       = "cache.morph_policy.size"
-
-	cfgAccessBoxCacheRemovingCheckInterval = "cache.accessbox.removing_check_interval"
 
 	// NATS.
 	cfgEnableNATS             = "nats.enabled"
@@ -165,7 +143,6 @@ const ( // Settings.
 	// Kludge.
 	cfgKludgeUseDefaultXMLNS                    = "kludge.use_default_xmlns"
 	cfgKludgeBypassContentEncodingCheckInChunks = "kludge.bypass_content_encoding_check_in_chunks"
-	cfgKludgeDefaultNamespaces                  = "kludge.default_namespaces"
 
 	// Web.
 	cfgWebReadTimeout       = "web.read_timeout"
@@ -173,9 +150,6 @@ const ( // Settings.
 	cfgWebWriteTimeout      = "web.write_timeout"
 	cfgWebIdleTimeout       = "web.idle_timeout"
 
-	// Namespaces.
-	cfgNamespacesConfig = "namespaces.config"
-
 	// Command line args.
 	cmdHelp      = "help"
 	cmdVersion   = "version"
@@ -193,34 +167,19 @@ const ( // Settings.
 	cfgClientCut = "frostfs.client_cut"
 	// Sets max buffer size for read payload in put operations.
 	cfgBufferMaxSizeForPut = "frostfs.buffer_max_size_for_put"
-	// Sets max attempt to make successful tree request.
-	cfgTreePoolMaxAttempts = "frostfs.tree_pool_max_attempts"
 
 	// List of allowed AccessKeyID prefixes.
 	cfgAllowedAccessKeyIDPrefixes = "allowed_access_key_id_prefixes"
 
 	// Bucket resolving options.
-	cfgResolveNamespaceHeader = "resolve_bucket.namespace_header"
-	cfgResolveBucketAllow     = "resolve_bucket.allow"
-	cfgResolveBucketDeny      = "resolve_bucket.deny"
+	cfgResolveBucketAllow = "resolve_bucket.allow"
+	cfgResolveBucketDeny  = "resolve_bucket.deny"
 
 	// Runtime.
 	cfgSoftMemoryLimit = "runtime.soft_memory_limit"
 
 	// Enable return MD5 checksum in ETag.
-	cfgMD5Enabled          = "features.md5.enabled"
-	cfgPolicyDenyByDefault = "features.policy.deny_by_default"
-
-	// FrostfsID.
-	cfgFrostfsIDContract          = "frostfsid.contract"
-	cfgFrostfsIDValidationEnabled = "frostfsid.validation.enabled"
-
-	// Policy.
-	cfgPolicyEnabled  = "policy.enabled"
-	cfgPolicyContract = "policy.contract"
-
-	// Proxy.
-	cfgProxyContract = "proxy.contract"
+	cfgMD5Enabled = "features.md5.enabled"
 
 	// envPrefix is an environment variables prefix used for configuration.
 	envPrefix = "S3_GW"
@@ -372,24 +331,6 @@ func fetchCacheSize(v *viper.Viper, l *zap.Logger, cfgEntry string, defaultValue
 	return defaultValue
 }
 
-func fetchRemovingCheckInterval(v *viper.Viper, l *zap.Logger) time.Duration {
-	if !v.IsSet(cfgAccessBoxCacheRemovingCheckInterval) {
-		return defaultAccessBoxCacheRemovingCheckInterval
-	}
-
-	duration := v.GetDuration(cfgAccessBoxCacheRemovingCheckInterval)
-	if duration >= 0 {
-		return duration
-	}
-
-	l.Error(logs.InvalidAccessBoxCacheRemovingCheckInterval,
-		zap.String("parameter", cfgAccessBoxCacheRemovingCheckInterval),
-		zap.Duration("value in config", duration),
-		zap.Duration("default", defaultAccessBoxCacheRemovingCheckInterval))
-
-	return defaultAccessBoxCacheRemovingCheckInterval
-}
-
 func fetchDefaultMaxAge(cfg *viper.Viper, l *zap.Logger) int {
 	defaultMaxAge := handler.DefaultMaxAge
 
@@ -501,88 +442,6 @@ func fetchCopiesNumbers(l *zap.Logger, v *viper.Viper) map[string][]uint32 {
 	return copiesNums
 }
 
-func fetchDefaultNamespaces(l *zap.Logger, v *viper.Viper) []string {
-	defaultNamespaces := v.GetStringSlice(cfgKludgeDefaultNamespaces)
-	if len(defaultNamespaces) == 0 {
-		defaultNamespaces = defaultDefaultNamespaces
-		l.Warn(logs.DefaultNamespacesCannotBeEmpty, zap.Strings("namespaces", defaultNamespaces))
-	}
-
-	for i := range defaultNamespaces { // to be set namespaces in env variable as `S3_GW_KLUDGE_DEFAULT_NAMESPACES="" 'root'`
-		defaultNamespaces[i] = strings.Trim(defaultNamespaces[i], "\"'")
-	}
-
-	return defaultNamespaces
-}
-
-func fetchNamespacesConfig(l *zap.Logger, v *viper.Viper) NamespacesConfig {
-	defaultNSRegionMap := fetchRegionMappingPolicies(l, v)
-	defaultNSRegionMap[defaultConstraintName] = fetchDefaultPolicy(l, v)
-
-	defaultNSCopiesNumbers := fetchCopiesNumbers(l, v)
-	defaultNSCopiesNumbers[defaultConstraintName] = fetchDefaultCopiesNumbers(l, v)
-
-	defaultNSValue := Namespace{
-		LocationConstraints: defaultNSRegionMap,
-		CopiesNumbers:       defaultNSCopiesNumbers,
-	}
-
-	nsConfig, err := readNamespacesConfig(v.GetString(cfgNamespacesConfig))
-	if err != nil {
-		l.Warn(logs.FailedToParseNamespacesConfig, zap.Error(err))
-	}
-
-	defaultNamespacesNames := fetchDefaultNamespaces(l, v)
-
-	var overrideDefaults []Namespace
-	for _, name := range defaultNamespacesNames {
-		if ns, ok := nsConfig.Namespaces[name]; ok {
-			overrideDefaults = append(overrideDefaults, ns)
-			delete(nsConfig.Namespaces, name)
-		}
-	}
-
-	if len(overrideDefaults) > 0 {
-		l.Warn(logs.DefaultNamespaceConfigValuesBeOverwritten)
-		defaultNSValue.LocationConstraints = overrideDefaults[0].LocationConstraints
-		defaultNSValue.CopiesNumbers = overrideDefaults[0].CopiesNumbers
-		if len(overrideDefaults) > 1 {
-			l.Warn(logs.MultipleDefaultOverridesFound, zap.String("name", overrideDefaults[0].Name))
-		}
-	}
-
-	for _, name := range defaultNamespacesNames {
-		nsConfig.Namespaces[name] = Namespace{
-			Name:                name,
-			LocationConstraints: defaultNSValue.LocationConstraints,
-			CopiesNumbers:       defaultNSValue.CopiesNumbers,
-		}
-	}
-
-	return nsConfig
-}
-
-func readNamespacesConfig(filepath string) (NamespacesConfig, error) {
-	nsConfig := NamespacesConfig{
-		Namespaces: make(Namespaces),
-	}
-
-	if filepath == "" {
-		return nsConfig, nil
-	}
-
-	data, err := os.ReadFile(filepath)
-	if err != nil {
-		return nsConfig, fmt.Errorf("failed to read namespace config '%s': %w", filepath, err)
-	}
-
-	if err = json.Unmarshal(data, &nsConfig); err != nil {
-		return nsConfig, fmt.Errorf("failed to parse namespace config: %w", err)
-	}
-
-	return nsConfig, nil
-}
-
 func fetchPeers(l *zap.Logger, v *viper.Viper) []pool.NodeParam {
 	var nodes []pool.NodeParam
 	for i := 0; ; i++ {
@@ -635,23 +494,6 @@ func fetchServers(v *viper.Viper) []ServerInfo {
 	return servers
 }
 
-func fetchAuthorizedKeys(l *zap.Logger, v *viper.Viper) keys.PublicKeys {
-	strKeys := v.GetStringSlice(cfgControlAuthorizedKeys)
-	pubs := make(keys.PublicKeys, 0, len(strKeys))
-
-	for i := range strKeys {
-		pub, err := keys.NewPublicKeyFromString(strKeys[i])
-		if err != nil {
-			l.Warn(logs.FailedToParsePublicKey, zap.String("key", strKeys[i]))
-			continue
-		}
-
-		pubs = append(pubs, pub)
-	}
-
-	return pubs
-}
-
 func newSettings() *viper.Viper {
 	v := viper.New()
 
@@ -697,8 +539,6 @@ func newSettings() *viper.Viper {
 
 	// set defaults:
 
-	v.SetDefault(cfgAccessBoxCacheRemovingCheckInterval, defaultAccessBoxCacheRemovingCheckInterval)
-
 	// logger:
 	v.SetDefault(cfgLoggerLevel, "debug")
 	v.SetDefault(cfgLoggerDestination, "stdout")
@@ -710,33 +550,17 @@ func newSettings() *viper.Viper {
 	v.SetDefault(cfgPProfAddress, "localhost:8085")
 	v.SetDefault(cfgPrometheusAddress, "localhost:8086")
 
-	v.SetDefault(cfgControlGRPCEndpoint, "localhost:8083")
-
 	// frostfs
 	v.SetDefault(cfgBufferMaxSizeForPut, 1024*1024) // 1mb
 
 	// kludge
 	v.SetDefault(cfgKludgeUseDefaultXMLNS, false)
 	v.SetDefault(cfgKludgeBypassContentEncodingCheckInChunks, false)
-	v.SetDefault(cfgKludgeDefaultNamespaces, defaultDefaultNamespaces)
 
 	// web
 	v.SetDefault(cfgWebReadHeaderTimeout, defaultReadHeaderTimeout)
 	v.SetDefault(cfgWebIdleTimeout, defaultIdleTimeout)
 
-	// frostfsid
-	v.SetDefault(cfgFrostfsIDContract, "frostfsid.frostfs")
-
-	// policy
-	v.SetDefault(cfgPolicyContract, "policy.frostfs")
-	v.SetDefault(cfgPolicyEnabled, true)
-
-	// proxy
-	v.SetDefault(cfgProxyContract, "proxy.frostfs")
-
-	// resolve
-	v.SetDefault(cfgResolveNamespaceHeader, defaultNamespaceHeader)
-
 	// Bind flags
 	if err := bindFlags(v, flags); err != nil {
 		panic(fmt.Errorf("bind flags: %w", err))
@@ -977,7 +801,7 @@ func newJournaldLogger(lvl zapcore.Level) *Logger {
 	c.EncoderConfig.EncodeTime = zapcore.ISO8601TimeEncoder
 	c.Level = zap.NewAtomicLevelAt(lvl)
 
-	encoder := zapjournald.NewPartialEncoder(zapcore.NewConsoleEncoder(c.EncoderConfig), zapjournald.SyslogFields)
+	encoder := zapcore.NewConsoleEncoder(c.EncoderConfig)
 
 	core := zapjournald.NewCore(zap.NewAtomicLevelAt(lvl), encoder, &journald.Journal{}, zapjournald.SyslogFields)
 	coreWithContext := core.With([]zapcore.Field{

cmd/s3-gw/decoder_test.go

@@ -2,7 +2,6 @@ package main
 
 import (
 	"bytes"
-	"encoding/json"
 	"testing"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/handler"
@@ -94,53 +93,3 @@ func TestDefaultNamespace(t *testing.T) {
 		})
 	}
 }
-
-func TestNamespacesMarshaling(t *testing.T) {
-	dataJSON := `
-{
-  "namespaces": {
-    "kapusta": {
-      "location_constraints": {
-        "default": "REP 3",
-        "load-1-1": "REP 1 CBF 1 SELECT 1 FROM *"
-      },
-      "copies_numbers": {
-        "default": [
-          0
-        ],
-        "load-1-1": [
-          1
-        ]
-      }
-    },
-    "root": {
-      "location_constraints": {
-        "default": "REP 3",
-        "test": "{\"replicas\":[{\"count\":1,\"selector\":\"\"}],\"containerBackupFactor\":1,\"selectors\":[{\"name\":\"\",\"count\":1,\"clause\":\"CLAUSE_UNSPECIFIED\",\"attribute\":\"\",\"filter\":\"Color\"}],\"filters\":[{\"name\":\"Color\",\"key\":\"Color\",\"op\":\"EQ\",\"value\":\"Red\",\"filters\":[]}],\"unique\":false}"
-      },
-      "copies_numbers": {
-        "default": [
-          0
-        ],
-        "load-1-1": [
-          1
-        ]
-      }
-    }
-  }
-}
-`
-
-	var nsConfig NamespacesConfig
-	err := json.Unmarshal([]byte(dataJSON), &nsConfig)
-	require.NoError(t, err)
-
-	data, err := json.Marshal(nsConfig)
-	require.NoError(t, err)
-
-	var nsConfig2 NamespacesConfig
-	err = json.Unmarshal(data, &nsConfig2)
-	require.NoError(t, err)
-
-	require.Equal(t, nsConfig, nsConfig2)
-}

cmd/s3-gw/namespaces.go

@@ -1,79 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/netmap"
-)
-
-type NamespacesConfig struct {
-	Namespaces Namespaces `json:"namespaces"`
-}
-
-type Namespaces map[string]Namespace
-
-type Namespace struct {
-	Name                string              `json:"-"`
-	LocationConstraints LocationConstraints `json:"location_constraints"`
-	CopiesNumbers       map[string][]uint32 `json:"copies_numbers"`
-}
-
-type LocationConstraints map[string]netmap.PlacementPolicy
-
-func (c *Namespaces) UnmarshalJSON(data []byte) error {
-	namespaces := make(map[string]Namespace)
-	if err := json.Unmarshal(data, &namespaces); err != nil {
-		return err
-	}
-
-	for name, namespace := range namespaces {
-		namespace.Name = name
-		namespaces[name] = namespace
-	}
-
-	*c = namespaces
-
-	return nil
-}
-
-func (c *LocationConstraints) UnmarshalJSON(data []byte) error {
-	m := make(map[string]string)
-	if err := json.Unmarshal(data, &m); err != nil {
-		return err
-	}
-
-	*c = make(LocationConstraints, len(m))
-	for region, policy := range m {
-		var pp netmap.PlacementPolicy
-		if err := pp.DecodeString(policy); err == nil {
-			(*c)[region] = pp
-			continue
-		}
-
-		if err := pp.UnmarshalJSON([]byte(policy)); err == nil {
-			(*c)[region] = pp
-			continue
-		}
-
-		return fmt.Errorf("failed to parse location contraint '%s': '%s'", region, policy)
-	}
-
-	return nil
-}
-
-func (c LocationConstraints) MarshalJSON() ([]byte, error) {
-	m := make(map[string]string, len(c))
-
-	for region, policy := range c {
-		var sb strings.Builder
-		if err := policy.WriteStringTo(&sb); err != nil {
-			return nil, err
-		}
-
-		m[region] = sb.String()
-	}
-
-	return json.Marshal(m)
-}

cmd/s3-gw/service.go

@@ -34,9 +34,6 @@ func (ms *Service) ShutDown(ctx context.Context) {
 	ms.log.Info(logs.ShuttingDownService, zap.String("endpoint", ms.Addr))
 	err := ms.Shutdown(ctx)
 	if err != nil {
-		ms.log.Error(logs.CantGracefullyShutDownService, zap.Error(err))
-		if err = ms.Close(); err != nil {
-			ms.log.Panic(logs.CantShutDownService, zap.Error(err))
-		}
+		ms.log.Panic(logs.CantShutDownService)
 	}
 }

config/config.env

@@ -33,12 +33,6 @@ S3_GW_SERVER_1_TLS_ENABLED=true
 S3_GW_SERVER_1_TLS_CERT_FILE=/path/to/tls/cert
 S3_GW_SERVER_1_TLS_KEY_FILE=/path/to/tls/key
 
-# Control API
-# List of hex-encoded public keys that have rights to use the Control Service
-S3_GW_CONTROL_AUTHORIZED_KEYS=035839e45d472a3b7769a2a1bd7d54c4ccd4943c3b40f547870e83a8fcbfb3ce11 028f42cfcb74499d7b15b35d9bff260a1c8d27de4f446a627406a382d8961486d6
-# Endpoint that is listened by the Control Service
-S3_GW_CONTROL_GRPC_ENDPOINT=localhost:8083
-
 # Domains to be able to use virtual-hosted-style access to bucket.
 S3_GW_LISTEN_DOMAINS=s3dev.frostfs.devenv
 
@@ -82,9 +76,6 @@ S3_GW_CACHE_OBJECTS_SIZE=1000000
 # Cache which keeps lists of objects in buckets
 S3_GW_CACHE_LIST_LIFETIME=1m
 S3_GW_CACHE_LIST_SIZE=100000
-# Cache which keeps listing session
-S3_GW_CACHE_LIST_SESSION_LIFETIME=1m
-S3_GW_CACHE_LIST_SESSION_SIZE=100
 # Cache which contains mapping of bucket name to bucket info
 S3_GW_CACHE_BUCKETS_LIFETIME=1m
 S3_GW_CACHE_BUCKETS_SIZE=1000
@@ -95,15 +86,11 @@ S3_GW_CACHE_NAMES_SIZE=10000
 S3_GW_CACHE_SYSTEM_LIFETIME=5m
 S3_GW_CACHE_SYSTEM_SIZE=100000
 # Cache which stores access box with tokens by its address
-S3_GW_CACHE_ACCESSBOX_REMOVING_CHECK_INTERVAL=5m
 S3_GW_CACHE_ACCESSBOX_LIFETIME=10m
 S3_GW_CACHE_ACCESSBOX_SIZE=100
 # Cache which stores owner to cache operation mapping
 S3_GW_CACHE_ACCESSCONTROL_LIFETIME=1m
 S3_GW_CACHE_ACCESSCONTROL_SIZE=100000
-# Cache which stores list of policy chains
-S3_GW_CACHE_MORPH_POLICY_LIFETIME=1m
-S3_GW_CACHE_MORPH_POLICY_SIZE=10000
 
 # NATS
 S3_GW_NATS_ENABLED=true
@@ -142,16 +129,11 @@ S3_GW_FROSTFS_SET_COPIES_NUMBER=0
 S3_GW_FROSTFS_CLIENT_CUT=false
 # Sets max buffer size for read payload in put operations.
 S3_GW_FROSTFS_BUFFER_MAX_SIZE_FOR_PUT=1048576
-# max attempt to make successful tree request.
-# default value is 0 that means the number of attempts equals to number of nodes in pool.
-S3_GW_FROSTFS_TREE_POOL_MAX_ATTEMPTS=0
 
 # List of allowed AccessKeyID prefixes
 # If not set, S3 GW will accept all AccessKeyIDs
 S3_GW_ALLOWED_ACCESS_KEY_ID_PREFIXES=Ck9BHsgKcnwfCTUSFm6pxhoNS4cBqgN2NQ8zVgPjqZDX 3stjWenX15YwYzczMr88gy3CQr4NYFBQ8P7keGzH5QFn
 
-# Header to determine zone to resolve bucket name
-S3_GW_RESOLVE_NAMESPACE_HEADER=X-Frostfs-Namespace
 # List of container NNS zones which are allowed or restricted to resolve with HEAD request
 S3_GW_RESOLVE_BUCKET_ALLOW=container
 # S3_GW_RESOLVE_BUCKET_DENY=
@@ -159,9 +141,7 @@ S3_GW_RESOLVE_BUCKET_ALLOW=container
 # Enable using default xml namespace `http://s3.amazonaws.com/doc/2006-03-01/` when parse xml bodies.
 S3_GW_KLUDGE_USE_DEFAULT_XMLNS=false
 # Use this flag to be able to use chunked upload approach without having `aws-chunked` value in `Content-Encoding` header.
-S3_GW_KLUDGE_BYPASS_CONTENT_ENCODING_CHECK_IN_CHUNKS=false
-# Namespaces that should be handled as default
-S3_GW_KLUDGE_DEFAULT_NAMESPACES="" "root"
+S3_GW_BYPASS_CONTENT_ENCODING_CHECK_IN_CHUNKS=false
 
 S3_GW_TRACING_ENABLED=false
 S3_GW_TRACING_ENDPOINT="localhost:4318"
@@ -170,8 +150,6 @@ S3_GW_TRACING_EXPORTER="otlp_grpc"
 S3_GW_RUNTIME_SOFT_MEMORY_LIMIT=1073741824
 
 S3_GW_FEATURES_MD5_ENABLED=false
-# Enable denying access for request that doesn't match any policy chain rules.
-S3_GW_FEATURES_POLICY_DENY_BY_DEFAULT=false
 
 # ReadTimeout is the maximum duration for reading the entire
 # request, including the body. A zero or negative value means
@@ -195,22 +173,3 @@ S3_GW_WEB_WRITE_TIMEOUT=0
 #	is zero, the value of ReadTimeout is used. If both are
 #	zero, there is no timeout.
 S3_GW_WEB_IDLE_TIMEOUT=30s
-
-# FrostfsID contract configuration. To enable this functionality the `rpc_endpoint` param must be also set.
-# FrostfsID contract hash (LE) or name in NNS.
-S3_GW_FROSTFSID_CONTRACT=frostfsid.frostfs
-# Enables a check to only allow requests to users registered in the FrostfsID contract.
-S3_GW_FROSTFSID_VALIDATION_ENABLED=true
-
-# Policy contract configuration. To enable this functionality the `rpc_endpoint` param must be also set.
-# Enables using policies from Policy contract.
-S3_GW_POLICY_ENABLED=true
-# Policy contract hash (LE) or name in NNS.
-S3_GW_POLICY_CONTRACT=policy.frostfs
-
-# Proxy contract configuration. To enable this functionality the `rpc_endpoint` param must be also set.
-# Proxy contract hash (LE) or name in NNS.
-S3_GW_PROXY_CONTRACT=proxy.frostfs
-
-# Namespaces configuration
-S3_GW_NAMESPACES_CONFIG=namespaces.json

config/config.yaml

@@ -37,15 +37,6 @@ server:
       cert_file: /path/to/cert
       key_file: /path/to/key
 
-control:
-  # List of hex-encoded public keys that have rights to use the Control Service
-  authorized_keys:
-    - 035839e45d472a3b7769a2a1bd7d54c4ccd4943c3b40f547870e83a8fcbfb3ce11
-    - 028f42cfcb74499d7b15b35d9bff260a1c8d27de4f446a627406a382d8961486d6
-  grpc:
-    # Endpoint that is listened by the Control Service
-    endpoint: localhost:8083
-
 # Domains to be able to use virtual-hosted-style access to bucket.
 listen_domains:
   - s3dev.frostfs.devenv
@@ -100,10 +91,6 @@ cache:
   list:
     lifetime: 1m
     size: 100
-  # Cache which keeps listing sessions
-  list_session:
-    lifetime: 1m
-    size: 100
   # Cache which contains mapping of nice name to object addresses
   names:
     lifetime: 1m
@@ -118,17 +105,12 @@ cache:
     size: 1000
   # Cache which stores access box with tokens by its address
   accessbox:
-    removing_check_interval: 5m
-    lifetime: 10m
-    size: 100
+    lifetime: 5m
+    size: 10
   # Cache which stores owner to cache operation mapping
   accesscontrol:
     lifetime: 1m
     size: 100000
-  # Cache which stores list of policy chains
-  morph_policy:
-    lifetime: 1m
-    size: 10000
 
 nats:
   enabled: true
@@ -168,7 +150,7 @@ cors:
 frostfs:
   # Numbers of the object copies (for each replica) to consider PUT to FrostFS successful.
   # `[0]` or empty list means that object will be processed according to the container's placement policy
-  set_copies_number: [ 0 ]
+  set_copies_number: [0]
   # This flag enables client side object preparing.
   client_cut: false
   # Sets max buffer size for read payload in put operations.
@@ -181,7 +163,6 @@ allowed_access_key_id_prefixes:
   - 3stjWenX15YwYzczMr88gy3CQr4NYFBQ8P7keGzH5QFn
 
 resolve_bucket:
-  namespace_header: X-Frostfs-Namespace
   allow:
     - container
   deny:
@@ -191,16 +172,11 @@ kludge:
   use_default_xmlns: false
   # Use this flag to be able to use chunked upload approach without having `aws-chunked` value in `Content-Encoding` header.
   bypass_content_encoding_check_in_chunks: false
-  # Namespaces that should be handled as default
-  default_namespaces: [ "", "root" ]
 
 runtime:
   soft_memory_limit: 1gb
 
 features:
-  policy:
-    # Enable denying access for request that doesn't match any policy chain rules.
-    deny_by_default: false
   md5:
     enabled: false
 
@@ -230,26 +206,3 @@ web:
   #	is zero, the value of ReadTimeout is used. If both are
   #	zero, there is no timeout.
   idle_timeout: 30s
-
-# FrostfsID contract configuration. To enable this functionality the `rpc_endpoint` param must be also set.
-frostfsid:
-  # FrostfsID contract hash (LE) or name in NNS.
-  contract: frostfsid.frostfs
-  validation:
-    # Enables a check to only allow requests to users registered in the FrostfsID contract.
-    enabled: true
-
-# Policy contract configuration. To enable this functionality the `rpc_endpoint` param must be also set.
-policy:
-  # Enables using policies from Policy contract.
-  enabled: true
-  # Policy contract hash (LE) or name in NNS.
-  contract: policy.frostfs
-
-# Proxy contract configuration. To enable this functionality the `rpc_endpoint` param must be also set.
-proxy:
-  # Proxy contract hash (LE) or name in NNS.
-  contract: proxy.frostfs
-
-namespaces:
-  config: namespaces.json

creds/tokens/credentials.go

@@ -9,45 +9,24 @@ import (
 
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/cache"
 	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/creds/accessbox"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
-	"go.uber.org/zap"
 )
 
 type (
 	// Credentials is a bearer token get/put interface.
 	Credentials interface {
 		GetBox(context.Context, oid.Address) (*accessbox.Box, error)
-		Put(context.Context, cid.ID, CredentialsParam) (oid.Address, error)
-		Update(context.Context, oid.Address, CredentialsParam) (oid.Address, error)
-	}
-
-	CredentialsParam struct {
-		OwnerID          user.ID
-		AccessBox        *accessbox.AccessBox
-		Expiration       uint64
-		Keys             keys.PublicKeys
-		CustomAttributes []object.Attribute
+		Put(context.Context, cid.ID, user.ID, *accessbox.AccessBox, uint64, ...*keys.PublicKey) (oid.Address, error)
+		Update(context.Context, oid.Address, user.ID, *accessbox.AccessBox, uint64, ...*keys.PublicKey) (oid.Address, error)
 	}
 
 	cred struct {
-		key                   *keys.PrivateKey
-		frostFS               FrostFS
-		cache                 *cache.AccessBoxCache
-		removingCheckDuration time.Duration
-		log                   *zap.Logger
-	}
-
-	Config struct {
-		FrostFS                     FrostFS
-		Key                         *keys.PrivateKey
-		CacheConfig                 *cache.Config
-		RemovingCheckAfterDurations time.Duration
+		key     *keys.PrivateKey
+		frostFS FrostFS
+		cache   *cache.AccessBoxCache
 	}
 )
 
@@ -71,9 +50,6 @@ type PrmObjectCreate struct {
 
 	// Object payload.
 	Payload []byte
-
-	// CustomAttributes are additional user provided attributes for box object.
-	CustomAttributes []object.Attribute
 }
 
 // FrostFS represents virtual connection to FrostFS network.
@@ -102,23 +78,17 @@ var (
 	ErrEmptyBearerToken = errors.New("Bearer token could not be empty")
 )
 
-var _ Credentials = (*cred)(nil)
+var _ = New
 
 // New creates a new Credentials instance using the given cli and key.
-func New(cfg Config) Credentials {
-	return &cred{
-		frostFS:               cfg.FrostFS,
-		key:                   cfg.Key,
-		cache:                 cache.NewAccessBoxCache(cfg.CacheConfig),
-		removingCheckDuration: cfg.RemovingCheckAfterDurations,
-		log:                   cfg.CacheConfig.Logger,
-	}
+func New(frostFS FrostFS, key *keys.PrivateKey, config *cache.Config) Credentials {
+	return &cred{frostFS: frostFS, key: key, cache: cache.NewAccessBoxCache(config)}
 }
 
 func (c *cred) GetBox(ctx context.Context, addr oid.Address) (*accessbox.Box, error) {
-	cachedBoxValue := c.cache.Get(addr)
-	if cachedBoxValue != nil {
-		return c.checkIfCredentialsAreRemoved(ctx, addr, cachedBoxValue)
+	cachedBox := c.cache.Get(addr)
+	if cachedBox != nil {
+		return cachedBox, nil
 	}
 
 	box, err := c.getAccessBox(ctx, addr)
@@ -126,48 +96,18 @@ func (c *cred) GetBox(ctx context.Context, addr oid.Address) (*accessbox.Box, er
 		return nil, fmt.Errorf("get access box: %w", err)
 	}
 
-	cachedBox, err := box.GetBox(c.key)
+	cachedBox, err = box.GetBox(c.key)
 	if err != nil {
-		return nil, fmt.Errorf("get gate box: %w", err)
+		return nil, fmt.Errorf("get box: %w", err)
 	}
 
-	c.putBoxToCache(addr, cachedBox)
+	if err = c.cache.Put(addr, cachedBox); err != nil {
+		return nil, fmt.Errorf("put box into cache: %w", err)
+	}
 
 	return cachedBox, nil
 }
 
-func (c *cred) checkIfCredentialsAreRemoved(ctx context.Context, addr oid.Address, cachedBoxValue *cache.AccessBoxCacheValue) (*accessbox.Box, error) {
-	if time.Since(cachedBoxValue.PutTime) < c.removingCheckDuration {
-		return cachedBoxValue.Box, nil
-	}
-
-	box, err := c.getAccessBox(ctx, addr)
-	if err != nil {
-		if client.IsErrObjectAlreadyRemoved(err) {
-			c.cache.Delete(addr)
-			return nil, fmt.Errorf("get access box: %w", err)
-		}
-		return cachedBoxValue.Box, nil
-	}
-
-	cachedBox, err := box.GetBox(c.key)
-	if err != nil {
-		c.cache.Delete(addr)
-		return nil, fmt.Errorf("get gate box: %w", err)
-	}
-	// we need this to reset PutTime
-	// to don't check for removing each time after removingCheckDuration interval
-	c.putBoxToCache(addr, cachedBox)
-
-	return cachedBoxValue.Box, nil
-}
-
-func (c *cred) putBoxToCache(addr oid.Address, box *accessbox.Box) {
-	if err := c.cache.Put(addr, box); err != nil {
-		c.log.Warn(logs.CouldntPutAccessBoxIntoCache, zap.String("address", addr.EncodeToString()))
-	}
-}
-
 func (c *cred) getAccessBox(ctx context.Context, addr oid.Address) (*accessbox.AccessBox, error) {
 	data, err := c.frostFS.GetCredsPayload(ctx, addr)
 	if err != nil {
@@ -183,34 +123,33 @@ func (c *cred) getAccessBox(ctx context.Context, addr oid.Address) (*accessbox.A
 	return &box, nil
 }
 
-func (c *cred) Put(ctx context.Context, idCnr cid.ID, prm CredentialsParam) (oid.Address, error) {
-	return c.createObject(ctx, idCnr, nil, prm)
+func (c *cred) Put(ctx context.Context, idCnr cid.ID, issuer user.ID, box *accessbox.AccessBox, expiration uint64, keys ...*keys.PublicKey) (oid.Address, error) {
+	return c.createObject(ctx, idCnr, nil, issuer, box, expiration, keys...)
 }
 
-func (c *cred) Update(ctx context.Context, addr oid.Address, prm CredentialsParam) (oid.Address, error) {
+func (c *cred) Update(ctx context.Context, addr oid.Address, issuer user.ID, box *accessbox.AccessBox, expiration uint64, keys ...*keys.PublicKey) (oid.Address, error) {
 	objID := addr.Object()
-	return c.createObject(ctx, addr.Container(), &objID, prm)
+	return c.createObject(ctx, addr.Container(), &objID, issuer, box, expiration, keys...)
 }
 
-func (c *cred) createObject(ctx context.Context, cnrID cid.ID, newVersionFor *oid.ID, prm CredentialsParam) (oid.Address, error) {
-	if len(prm.Keys) == 0 {
+func (c *cred) createObject(ctx context.Context, cnrID cid.ID, newVersionFor *oid.ID, issuer user.ID, box *accessbox.AccessBox, expiration uint64, keys ...*keys.PublicKey) (oid.Address, error) {
+	if len(keys) == 0 {
 		return oid.Address{}, ErrEmptyPublicKeys
-	} else if prm.AccessBox == nil {
+	} else if box == nil {
 		return oid.Address{}, ErrEmptyBearerToken
 	}
-	data, err := prm.AccessBox.Marshal()
+	data, err := box.Marshal()
 	if err != nil {
 		return oid.Address{}, fmt.Errorf("marshall box: %w", err)
 	}
 
 	idObj, err := c.frostFS.CreateObject(ctx, PrmObjectCreate{
-		Creator:          prm.OwnerID,
-		Container:        cnrID,
-		Filepath:         strconv.FormatInt(time.Now().Unix(), 10) + "_access.box",
-		ExpirationEpoch:  prm.Expiration,
-		NewVersionFor:    newVersionFor,
-		Payload:          data,
-		CustomAttributes: prm.CustomAttributes,
+		Creator:         issuer,
+		Container:       cnrID,
+		Filepath:        strconv.FormatInt(time.Now().Unix(), 10) + "_access.box",
+		ExpirationEpoch: expiration,
+		NewVersionFor:   newVersionFor,
+		Payload:         data,
 	})
 	if err != nil {
 		return oid.Address{}, fmt.Errorf("create object: %w", err)

creds/tokens/credentials_test.go

@@ -1,91 +0,0 @@
-package tokens
-
-import (
-	"context"
-	"encoding/hex"
-	"errors"
-	"testing"
-	"time"
-
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/cache"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/creds/accessbox"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
-	apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status"
-	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
-	oidtest "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id/test"
-	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
-	"github.com/stretchr/testify/require"
-	"go.uber.org/zap/zaptest"
-)
-
-type frostfsMock struct {
-	objects map[oid.Address][]byte
-	errors  map[oid.Address]error
-}
-
-func (f *frostfsMock) CreateObject(context.Context, PrmObjectCreate) (oid.ID, error) {
-	panic("implement me for test")
-}
-
-func (f *frostfsMock) GetCredsPayload(_ context.Context, address oid.Address) ([]byte, error) {
-	if err := f.errors[address]; err != nil {
-		return nil, err
-	}
-
-	data, ok := f.objects[address]
-	if !ok {
-		return nil, errors.New("not found")
-	}
-	return data, nil
-}
-
-func TestRemovingAccessBox(t *testing.T) {
-	ctx := context.Background()
-
-	key, err := keys.NewPrivateKey()
-	require.NoError(t, err)
-
-	gateData := []*accessbox.GateData{{
-		BearerToken: &bearer.Token{},
-		GateKey:     key.PublicKey(),
-	}}
-
-	secretKey := "713d0a0b9efc7d22923e17b0402a6a89b4273bc711c8bacb2da1b643d0006aeb"
-	sk, err := hex.DecodeString(secretKey)
-	require.NoError(t, err)
-
-	accessBox, _, err := accessbox.PackTokens(gateData, sk)
-	require.NoError(t, err)
-	data, err := accessBox.Marshal()
-	require.NoError(t, err)
-
-	addr := oidtest.Address()
-	frostfs := &frostfsMock{
-		objects: map[oid.Address][]byte{addr: data},
-		errors:  map[oid.Address]error{},
-	}
-
-	cfg := Config{
-		FrostFS: frostfs,
-		Key:     key,
-		CacheConfig: &cache.Config{
-			Size:     10,
-			Lifetime: 24 * time.Hour,
-			Logger:   zaptest.NewLogger(t),
-		},
-		RemovingCheckAfterDurations: 0, // means check always
-	}
-
-	creds := New(cfg)
-
-	_, err = creds.GetBox(ctx, addr)
-	require.NoError(t, err)
-
-	frostfs.errors[addr] = errors.New("network error")
-	_, err = creds.GetBox(ctx, addr)
-	require.NoError(t, err)
-
-	frostfs.errors[addr] = &apistatus.ObjectAlreadyRemoved{}
-	_, err = creds.GetBox(ctx, addr)
-	require.Error(t, err)
-}

docs/authmate.md

@@ -143,9 +143,6 @@ the secret. Format of `access_key_id`: `%cid0%oid`, where 0(zero) is a delimiter
 * `--access-key-id` -- credentials that you want to update (e.g. to add more gates that can use your creds)
 without changing values of `aws_access_key_id` and `aws_secret_access_key`. If you want to update credential you MUST
 provide also secret key using `AUTHMATE_SECRET_ACCESS_KEY` env variable.
-* `--frostfsid` -- FrostfsID contract hash (LE) or name in NNS to register public key in contract
-(`--rpc-endpoint` flag also must be provided).
-* `--rpc-endpoint` -- NEO node RPC address.
 
 ### Bearer tokens
 

docs/configuration.md

@@ -175,7 +175,6 @@ There are some custom types used for brevity:
 | `peers`            | [Nodes configuration](#peers-section)                          |
 | `placement_policy` | [Placement policy configuration](#placement_policy-section)    |
 | `server`           | [Server configuration](#server-section)                        |
-| `control`          | [Control API configuration](#control-section)                  |
 | `logger`           | [Logger configuration](#logger-section)                        |
 | `cache`            | [Cache configuration](#cache-section)                          |
 | `nats`             | [NATS configuration](#nats-section)                            |
@@ -189,10 +188,6 @@ There are some custom types used for brevity:
 | `runtime`          | [Runtime configuration](#runtime-section)                      |
 | `features`         | [Features configuration](#features-section)                    |
 | `web`              | [Web server configuration](#web-section)                       |
-| `frostfsid`        | [FrostfsID configuration](#frostfsid-section)                  |
-| `policy`           | [Policy contract configuration](#policy-section)               |
-| `proxy`            | [Proxy contract configuration](#proxy-section)                 |
-| `namespaces`       | [Namespaces configuration](#namespaces-section)                |
 
 ### General section
 
@@ -220,19 +215,19 @@ allowed_access_key_id_prefixes:
    - 3stjWenX15YwYzczMr88gy3CQr4NYFBQ8P7keGzH5QFn
 ```
 
-| Parameter                        | Type       | SIGHUP reload | Default value | Description                                                                                                                                                                          |
-|----------------------------------|------------|---------------|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `listen_domains`                 | `[]string` | no            |               | Domains to be able to use virtual-hosted-style access to bucket.                                                                                                                     |
-| `rpc_endpoint`                   | `string`   | no            |               | The address of the RPC host to which the gateway connects to resolve bucket names and interact with frostfs contracts (required to use the `nns` resolver and `frostfsid` contract). |
-| `resolve_order`                  | `[]string` | yes           | `[dns]`       | Order of bucket name resolvers to use. Available resolvers: `dns`, `nns`.                                                                                                            |
-| `connect_timeout`                | `duration` | no            | `10s`         | Timeout to connect to a node.                                                                                                                                                        |
-| `stream_timeout`                 | `duration` | no            | `10s`         | Timeout for individual operations in streaming RPC.                                                                                                                                  |
-| `healthcheck_timeout`            | `duration` | no            | `15s`         | Timeout to check node health during rebalance.                                                                                                                                       |
-| `rebalance_interval`             | `duration` | no            | `60s`         | Interval to check node health.                                                                                                                                                       |
-| `pool_error_threshold`           | `uint32`   | no            | `100`         | The number of errors on connection after which node is considered as unhealthy.                                                                                                      |
-| `max_clients_count`              | `int`      | no            | `100`         | Limits for processing of clients' requests.                                                                                                                                          |
-| `max_clients_deadline`           | `duration` | no            | `30s`         | Deadline after which the gate sends error `RequestTimeout` to a client.                                                                                                              |
-| `allowed_access_key_id_prefixes` | `[]string` | no            |               | List of allowed `AccessKeyID` prefixes which S3 GW serve. If the parameter is omitted, all `AccessKeyID` will be accepted.                                                           |
+| Parameter                        | Type       | SIGHUP reload | Default value  | Description                                                                                                                                                                                                       |
+|----------------------------------|------------|---------------|----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `listen_domains`                 | `[]string` |               |                | Domains to be able to use virtual-hosted-style access to bucket.                                                                                                                                                  |
+| `rpc_endpoint`                   | `string`   | yes           |                | The address of the RPC host to which the gateway connects to resolve bucket names (required to use the `nns` resolver).                                                                                           |
+| `resolve_order`                  | `[]string` | yes           | `[dns]`        | Order of bucket name resolvers to use. Available resolvers: `dns`, `nns`.                                                                                                                                         |                                                                                                                                                                           |
+| `connect_timeout`                | `duration` |               | `10s`          | Timeout to connect to a node.                                                                                                                                                                                     |
+| `stream_timeout`                 | `duration` |               | `10s`          | Timeout for individual operations in streaming RPC.                                                                                                                                                               |
+| `healthcheck_timeout`            | `duration` |               | `15s`          | Timeout to check node health during rebalance.                                                                                                                                                                    |
+| `rebalance_interval`             | `duration` |               | `60s`          | Interval to check node health.                                                                                                                                                                                    |
+| `pool_error_threshold`           | `uint32`   |               | `100`          | The number of errors on connection after which node is considered as unhealthy.                                                                                                                                   |
+| `max_clients_count`              | `int`      |               | `100`          | Limits for processing of clients' requests.                                                                                                                                                                       |
+| `max_clients_deadline`           | `duration` |               | `30s`          | Deadline after which the gate sends error `RequestTimeout` to a client.                                                                                                                                           |
+| `allowed_access_key_id_prefixes` | `[]string` |               |                | List of allowed `AccessKeyID` prefixes which S3 GW serve. If the parameter is omitted, all `AccessKeyID` will be accepted.                                                                                        |
 
 ### `wallet` section
 
@@ -355,24 +350,6 @@ server:
 | `tls.cert_file` | `string` | yes           |                | Path to the TLS certificate.                  |
 | `tls.key_file`  | `string` | yes           |                | Path to the key.                              |
 
-### `control` section
-
-Control API parameters.
-
-```yaml
-control:
-  authorized_keys:  
-    - 035839e45d472a3b7769a2a1bd7d54c4ccd4943c3b40f547870e83a8fcbfb3ce11
-    - 028f42cfcb74499d7b15b35d9bff260a1c8d27de4f446a627406a382d8961486d6
-  grpc:
-    endpoint: localhost:8083
-```
-
-| Parameter         | Type       | SIGHUP reload | Default value    | Description                                                                  |
-|-------------------|------------|---------------|------------------|------------------------------------------------------------------------------|
-| `authorized_keys` | `[]string` | yes           |                  | List of hex-encoded public keys that have rights to use the Control Service. |
-| `grpc.endpoint`   | `string`   |               | `localhost:8083` | Endpoint that is listened by the Control Service.                            |
-
 ### `logger` section
 
 ```yaml
@@ -396,9 +373,6 @@ cache:
   list:
     lifetime: 1m
     size: 100
-  list_session:
-    lifetime: 1m
-    size: 100
   names:
     lifetime: 1m
     size: 1000
@@ -409,28 +383,22 @@ cache:
     lifetime: 2m
     size: 1000
   accessbox:
-    removing_check_interval: 5m
-    lifetime: 10m
-    size: 100
+    lifetime: 5m
+    size: 10
   accesscontrol:
     lifetime: 1m
     size: 100000
-  morph_policy:
-    lifetime: 30s
-    size: 10000
 ```
 
-| Parameter       | Type                                            | Default value                     | Description                                                                            |
-|-----------------|-------------------------------------------------|-----------------------------------|----------------------------------------------------------------------------------------|
-| `objects`       | [Cache config](#cache-subsection)               | `lifetime: 5m`<br>`size: 1000000` | Cache for objects (FrostFS headers).                                                   |
-| `list`          | [Cache config](#cache-subsection)               | `lifetime: 60s`<br>`size: 100000` | Cache which keeps lists of objects in buckets.                                         |
-| `list_session`  | [Cache config](#cache-subsection)               | `lifetime: 60s`<br>`size: 100`    | Cache which keeps listing session.                                                     |
-| `names`         | [Cache config](#cache-subsection)               | `lifetime: 60s`<br>`size: 10000`  | Cache which contains mapping of nice name to object addresses.                         |
-| `buckets`       | [Cache config](#cache-subsection)               | `lifetime: 60s`<br>`size: 1000`   | Cache which contains mapping of bucket name to bucket info.                            |
-| `system`        | [Cache config](#cache-subsection)               | `lifetime: 5m`<br>`size: 10000`   | Cache for system objects in a bucket: bucket settings, notification configuration etc. |
-| `accessbox`     | [Accessbox cache config](#accessbox-subsection) | `lifetime: 10m`<br>`size: 100`    | Cache which stores access box with tokens by its address.                              |
-| `accesscontrol` | [Cache config](#cache-subsection)               | `lifetime: 1m`<br>`size: 100000`  | Cache which stores owner to cache operation mapping.                                   |
-| `morph_policy`  | [Cache config](#cache-subsection)               | `lifetime: 1m`<br>`size: 10000`   | Cache which stores list of policy chains.                                              |
+| Parameter       | Type                              | Default value                     | Description                                                                            |
+|-----------------|-----------------------------------|-----------------------------------|----------------------------------------------------------------------------------------|
+| `objects`       | [Cache config](#cache-subsection) | `lifetime: 5m`<br>`size: 1000000` | Cache for objects (FrostFS headers).                                                   |
+| `list`          | [Cache config](#cache-subsection) | `lifetime: 60s`<br>`size: 100000` | Cache which keeps lists of objects in buckets.                                         |
+| `names`         | [Cache config](#cache-subsection) | `lifetime: 60s`<br>`size: 10000`  | Cache which contains mapping of nice name to object addresses.                         |
+| `buckets`       | [Cache config](#cache-subsection) | `lifetime: 60s`<br>`size: 1000`   | Cache which contains mapping of bucket name to bucket info.                            |
+| `system`        | [Cache config](#cache-subsection) | `lifetime: 5m`<br>`size: 10000`   | Cache for system objects in a bucket: bucket settings, notification configuration etc. |
+| `accessbox`     | [Cache config](#cache-subsection) | `lifetime: 10m`<br>`size: 100`    | Cache which stores access box with tokens by its address.                              |
+| `accesscontrol` | [Cache config](#cache-subsection) | `lifetime: 1m`<br>`size: 100000`  | Cache which stores owner to cache operation mapping.                                   |
 
 #### `cache` subsection
 
@@ -444,20 +412,6 @@ size: 1000
 | `lifetime` | `duration` | depends on cache | Lifetime of entries in cache. |
 | `size`     | `int`      | depends on cache | LRU cache size.               |
 
-#### `accessbox` subsection
-
-```yaml
-
-lifetime: 10m
-size: 100
-```
-
-| Parameter                 | Type       | Default value | Description                                           |
-|---------------------------|------------|---------------|-------------------------------------------------------|
-| `removing_check_interval` | `duration` | `5m'          | Time after which creds should be checked for removal. |
-| `lifetime`                | `duration` | '10m'         | Lifetime of entries in cache.                         |
-| `size`                    | `int`      | '100          | LRU cache size.                                       |
-
 ### `nats` section
 
 This is an advanced section, use with caution.
@@ -560,7 +514,6 @@ frostfs:
   set_copies_number: [0]
   client_cut: false
   buffer_max_size_for_put: 1048576 # 1mb
-  tree_pool_max_attempts: 0
 ```
 
 | Parameter                 | Type       | SIGHUP reload | Default value | Description                                                                                                                                                                                                     |
@@ -568,25 +521,22 @@ frostfs:
 | `set_copies_number`       | `[]uint32` | yes           | `[0]`         | Numbers of the object copies (for each replica) to consider PUT to FrostFS successful. <br/>Default value `[0]` or empty list means that object will be processed according to the container's placement policy |
 | `client_cut`              | `bool`     | yes           | `false`       | This flag enables client side object preparing.                                                                                                                                                                 |
 | `buffer_max_size_for_put` | `uint64`   | yes           | `1048576`     | Sets max buffer size for read payload in put operations.                                                                                                                                                        |
-| `tree_pool_max_attempts`  | `uint32`   | no            | `0`           | Sets max attempt to make successful tree request. Value 0 means the number of attempts equals to number of nodes in pool.                                                                                       |
 
 # `resolve_bucket` section
 
-Bucket name resolving parameters from and to container ID.
+Bucket name resolving parameters from and to container ID with `HEAD` request.
 
 ```yaml
 resolve_bucket:
-  namespace_header: X-Frostfs-Namespace
   allow:
     - container
   deny:
 ```
 
-| Parameter          | Type       | SIGHUP reload | Default value         | Description                                                                                                              |
-|--------------------|------------|---------------|-----------------------|--------------------------------------------------------------------------------------------------------------------------|
-| `namespace_header` | `string`   | yes           | `X-Frostfs-Namespace` | Header to determine zone to resolve bucket name.                                                                         |
-| `allow`            | `[]string` | no            |                       | List of container zones which are available to resolve. Mutual exclusive with `deny` list. Prioritized over `deny` list. |
-| `deny`             | `[]string` | no            |                       | List of container zones which are restricted to resolve. Mutual exclusive with `allow` list.                             |
+| Parameter | Type       | Default value | Description                                                                                                              |
+|-----------|------------|---------------|--------------------------------------------------------------------------------------------------------------------------|
+| `allow`   | `[]string` |               | List of container zones which are available to resolve. Mutual exclusive with `deny` list. Prioritized over `deny` list. |
+| `deny`    | `[]string` |               | List of container zones which are restricted to resolve. Mutual exclusive with `allow` list.                             |
 
 # `kludge` section
 
@@ -596,14 +546,12 @@ Workarounds for non-standard use cases.
 kludge:
   use_default_xmlns: false
   bypass_content_encoding_check_in_chunks: false
-  default_namespaces: [ "", "root" ]
 ```
 
-| Parameter                                 | Type       | SIGHUP reload | Default value | Description                                                                                                                                                                                      |
-|-------------------------------------------|------------|---------------|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `use_default_xmlns`                       | `bool`     | yes           | false         | Enable using default xml namespace `http://s3.amazonaws.com/doc/2006-03-01/` when parse xml bodies.                                                                                              |
+| Parameter                                 | Type       | SIGHUP reload | Default value | Description                                                                                                                     |
+|-------------------------------------------|------------|---------------|---------------|---------------------------------------------------------------------------------------------------------------------------------|
+| `use_default_xmlns`                       | `bool`     | yes           | false         | Enable using default xml namespace `http://s3.amazonaws.com/doc/2006-03-01/` when parse xml bodies.                             |
 | `bypass_content_encoding_check_in_chunks` | `bool`     | yes           | false         | Use this flag to be able to use [chunked upload approach](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html) without having `aws-chunked` value in `Content-Encoding` header. |
-| `default_namespaces`                      | `[]string` | n/d           | ["","root"]   | Namespaces that should be handled as default.                                                                                                                                                    |
 
 # `runtime` section
 Contains runtime parameters.
@@ -622,16 +570,13 @@ Contains parameters for enabling features.
 
 ```yaml
 features:
-   policy:
-      deny_by_default: false
    md5:
       enabled: false
 ```
 
-| Parameter                | Type   | SIGHUP reload | Default value | Description                                                                  |
-|--------------------------|--------|---------------|---------------|------------------------------------------------------------------------------|
-| `md5.enabled`            | `bool` | yes           | false         | Flag to enable return MD5 checksum in ETag headers and fields.               |
-| `policy.deny_by_default` | `bool` | yes           | false         | Enable denying access for request that doesn't match any policy chain rules. |
+| Parameter     | Type   | SIGHUP reload | Default value | Description                                                    |
+|---------------|--------|---------------|---------------|----------------------------------------------------------------|
+| `md5.enabled` | `bool` | yes           | false         | Flag to enable return MD5 checksum in ETag headers and fields. |
 
 # `web` section
 Contains web server configuration parameters.
@@ -650,84 +595,3 @@ web:
 | `read_header_timeout` | `duration` | no            | `30s`         | The amount of time allowed to read request headers. If `read_header_timeout` is zero, the value of `read_timeout` is used. If both are zero, there is no timeout.                            |
 | `write_timeout`       | `duration` | no            | `0`           | The maximum duration before timing out writes of the response. A zero or negative value means there will be no timeout.                                                                      |
 | `idle_timeout`        | `duration` | no            | `30s`         | The maximum amount of time to wait for the next request when keep-alives are enabled. If `idle_timeout` is zero, the value of `read_timeout` is used. If both are zero, there is no timeout. |
-
-# `frostfsid` section
-
-FrostfsID contract configuration. To enable this functionality the `rpc_endpoint` param must be also set.
-
-```yaml
-frostfsid:
-  contract: frostfsid.frostfs
-  validation:
-   enabled: false
-```
-
-| Parameter            | Type     | SIGHUP reload | Default value       | Description                                                                           |
-|----------------------|----------|---------------|---------------------|---------------------------------------------------------------------------------------|
-| `contract`           | `string` | no            | `frostfsid.frostfs` | FrostfsID contract hash (LE) or name in NNS.                                          |
-| `validation.enabled` | `bool`   | no            | `false`             | Enables a check to only allow requests to users registered in the FrostfsID contract. |
-
-# `policy` section
-
-Policy contract configuration. To enable this functionality the `rpc_endpoint` param must be also set.
-
-```yaml
-policy:
-  enabled: false
-  contract: policy.frostfs
-```
-
-| Parameter  | Type     | SIGHUP reload | Default value  | Description                                                       |
-|------------|----------|---------------|----------------|-------------------------------------------------------------------|
-| `enabled`  | `bool`   | no            | true           | Enables using policies from Policy contract to check permissions. |
-| `contract` | `string` | no            | policy.frostfs | Policy contract hash (LE) or name in NNS.                         |
-
-# `proxy` section
-
-Proxy contract configuration. To enable this functionality the `rpc_endpoint` param must be also set.
-
-```yaml
-proxy:
-  contract: proxy.frostfs
-```
-
-| Parameter  | Type     | SIGHUP reload | Default value   | Description                              |
-|------------|----------|---------------|-----------------|------------------------------------------|
-| `contract` | `string` | no            | `proxy.frostfs` | Proxy contract hash (LE) or name in NNS. |
-
-# `namespaces` section
-
-Namespaces configuration.
-
-```yaml
-namespaces:
-  config: namespace.json
-```
-
-| Parameter | Type     | SIGHUP reload | Default value | Description                                         |
-|-----------|----------|---------------|---------------|-----------------------------------------------------|
-| `config`  | `string` | yes           |               | Path to json file with config value for namespaces. |
-
-## `namespaces.config` subsection
-
-Example of `namespaces.json`.
-Note that config values from `namespaces.json` can override config values for default namespaces
-(value for which are fetched from regular config value e.g. [placement-policy](#placement_policy-section)).
-To override config values for default namespaces use namespace names that are provided in `kludge.default_namespaces`.
-
-```json
-{
-  "namespaces": {
-    "namespace1": {
-      "location_constraints": {
-        "default": "REP 3",
-        "test": "{\"replicas\":[{\"count\":1,\"selector\":\"\"}],\"containerBackupFactor\":0,\"selectors\":[],\"filters\":[],\"unique\":false}"
-      },
-      "copies_numbers": {
-        "default": [ 0 ],
-        "test": [ 1 ]
-      }
-    }
-  }
-}
-```

go.mod

@@ -3,19 +3,17 @@ module git.frostfs.info/TrueCloudLab/frostfs-s3-gw
 go 1.20
 
 require (
-	git.frostfs.info/TrueCloudLab/frostfs-api-go/v2 v2.16.1-0.20231121085847-241a9f1ad0a4
-	git.frostfs.info/TrueCloudLab/frostfs-contract v0.18.1-0.20231218084346-bce7ef18c83b
+	git.frostfs.info/TrueCloudLab/frostfs-api-go/v2 v2.15.1-0.20230802075510-964c3edb3f44
 	git.frostfs.info/TrueCloudLab/frostfs-observability v0.0.0-20230531082742-c97d21411eb6
-	git.frostfs.info/TrueCloudLab/frostfs-sdk-go v0.0.0-20231107114540-ab75edd70939
-	git.frostfs.info/TrueCloudLab/policy-engine v0.0.0-20240206111236-8354a074c4df
-	git.frostfs.info/TrueCloudLab/zapjournald v0.0.0-20240124114243-cb2e66427d02
+	git.frostfs.info/TrueCloudLab/frostfs-sdk-go v0.0.0-20231003164722-60463871dbc2
+	git.frostfs.info/TrueCloudLab/zapjournald v0.0.0-20231018083019-2b6d84de9a3d
 	github.com/aws/aws-sdk-go v1.44.6
 	github.com/bluele/gcache v0.0.2
 	github.com/go-chi/chi/v5 v5.0.8
-	github.com/google/uuid v1.3.1
+	github.com/google/uuid v1.3.0
 	github.com/minio/sio v0.3.0
 	github.com/nats-io/nats.go v1.13.1-0.20220121202836-972a071d373d
-	github.com/nspcc-dev/neo-go v0.104.1-0.20231206061802-441eb8aa86be
+	github.com/nspcc-dev/neo-go v0.101.2-0.20230601131642-a0117042e8fc
 	github.com/panjf2000/ants/v2 v2.5.0
 	github.com/prometheus/client_golang v1.15.1
 	github.com/prometheus/client_model v0.3.0
@@ -23,23 +21,24 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.15.0
 	github.com/ssgreg/journald v1.0.0
-	github.com/stretchr/testify v1.8.4
+	github.com/stretchr/testify v1.8.3
 	github.com/urfave/cli/v2 v2.3.0
 	go.opentelemetry.io/otel v1.16.0
 	go.opentelemetry.io/otel/trace v1.16.0
-	go.uber.org/zap v1.26.0
-	golang.org/x/crypto v0.14.0
-	golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63
-	google.golang.org/grpc v1.59.0
-	google.golang.org/protobuf v1.31.0
+	go.uber.org/zap v1.24.0
+	golang.org/x/crypto v0.9.0
+	google.golang.org/grpc v1.55.0
+	google.golang.org/protobuf v1.30.0
 )
 
 require (
+	git.frostfs.info/TrueCloudLab/frostfs-contract v0.0.0-20230307110621-19a8ef2d02fb // indirect
 	git.frostfs.info/TrueCloudLab/frostfs-crypto v0.6.0 // indirect
 	git.frostfs.info/TrueCloudLab/hrw v1.2.1 // indirect
 	git.frostfs.info/TrueCloudLab/rfc6979 v0.4.0 // indirect
 	git.frostfs.info/TrueCloudLab/tzhash v1.8.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
+	github.com/benbjohnson/clock v1.1.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
@@ -50,24 +49,23 @@ require (
 	github.com/go-logr/logr v1.2.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang/snappy v0.0.3 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 // indirect
 	github.com/hashicorp/golang-lru v0.6.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.2 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/nats-io/nats-server/v2 v2.7.1 // indirect
 	github.com/nats-io/nkeys v0.3.0 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
-	github.com/nspcc-dev/go-ordered-json v0.0.0-20231123160306-3374ff1e7a3c // indirect
-	github.com/nspcc-dev/neo-go/pkg/interop v0.0.0-20231127165613-b35f351f0ba0 // indirect
+	github.com/nspcc-dev/go-ordered-json v0.0.0-20220111165707-25110be27d22 // indirect
+	github.com/nspcc-dev/neo-go/pkg/interop v0.0.0-20230615193820-9185820289ce // indirect
 	github.com/nspcc-dev/rfc6979 v0.2.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.6 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
@@ -87,15 +85,15 @@ require (
 	go.opentelemetry.io/otel/metric v1.16.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.16.0 // indirect
 	go.opentelemetry.io/proto/otlp v0.19.0 // indirect
+	go.uber.org/atomic v1.10.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/net v0.17.0 // indirect
-	golang.org/x/sync v0.3.0 // indirect
-	golang.org/x/sys v0.13.0 // indirect
-	golang.org/x/term v0.13.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
-	google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4 // indirect
+	golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc // indirect
+	golang.org/x/net v0.10.0 // indirect
+	golang.org/x/sync v0.2.0 // indirect
+	golang.org/x/sys v0.8.0 // indirect
+	golang.org/x/term v0.8.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
+	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -36,43 +36,76 @@ cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RX
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-git.frostfs.info/TrueCloudLab/frostfs-api-go/v2 v2.16.1-0.20231121085847-241a9f1ad0a4 h1:wjLfZ3WCt7qNGsQv+Jl0TXnmtg0uVk/jToKPFTBc/jo=
-git.frostfs.info/TrueCloudLab/frostfs-api-go/v2 v2.16.1-0.20231121085847-241a9f1ad0a4/go.mod h1:uY0AYmCznjZdghDnAk7THFIe1Vlg531IxUcus7ZfUJI=
-git.frostfs.info/TrueCloudLab/frostfs-contract v0.18.1-0.20231218084346-bce7ef18c83b h1:zdbOxyqkxRyOLc7/2oNFu5tBwwg0Q6+0tJM3RkAxHlE=
-git.frostfs.info/TrueCloudLab/frostfs-contract v0.18.1-0.20231218084346-bce7ef18c83b/go.mod h1:YMFtNZy2MgeiSwt0t8lqk8dYBGzlbhmV1cbbstJJ6oY=
+git.frostfs.info/TrueCloudLab/frostfs-api-go/v2 v2.15.1-0.20230802075510-964c3edb3f44 h1:v6JqBD/VzZx3QSxbaXnUwnnJ1KEYheU4LzLGr3IhsAE=
+git.frostfs.info/TrueCloudLab/frostfs-api-go/v2 v2.15.1-0.20230802075510-964c3edb3f44/go.mod h1:pKJJRLOChW4zDQsAt1e8k/snWKljJtpkiPfxV53ngjI=
+git.frostfs.info/TrueCloudLab/frostfs-contract v0.0.0-20230307110621-19a8ef2d02fb h1:S/TrbOOu9qEXZRZ9/Ddw7crnxbBUQLo68PSzQWYrc9M=
+git.frostfs.info/TrueCloudLab/frostfs-contract v0.0.0-20230307110621-19a8ef2d02fb/go.mod h1:nkR5gaGeez3Zv2SE7aceP0YwxG2FzIB5cGKpQO2vV2o=
 git.frostfs.info/TrueCloudLab/frostfs-crypto v0.6.0 h1:FxqFDhQYYgpe41qsIHVOcdzSVCB8JNSfPG7Uk4r2oSk=
 git.frostfs.info/TrueCloudLab/frostfs-crypto v0.6.0/go.mod h1:RUIKZATQLJ+TaYQa60X2fTDwfuhMfm8Ar60bQ5fr+vU=
 git.frostfs.info/TrueCloudLab/frostfs-observability v0.0.0-20230531082742-c97d21411eb6 h1:aGQ6QaAnTerQ5Dq5b2/f9DUQtSqPkZZ/bkMx/HKuLCo=
 git.frostfs.info/TrueCloudLab/frostfs-observability v0.0.0-20230531082742-c97d21411eb6/go.mod h1:W8Nn08/l6aQ7UlIbpF7FsQou7TVpcRD1ZT1KG4TrFhE=
-git.frostfs.info/TrueCloudLab/frostfs-sdk-go v0.0.0-20231107114540-ab75edd70939 h1:jZEepi9yWmqrWgLRQcHQu4YPJaudmd7d2AEhpmM3m4U=
-git.frostfs.info/TrueCloudLab/frostfs-sdk-go v0.0.0-20231107114540-ab75edd70939/go.mod h1:t1akKcUH7iBrFHX8rSXScYMP17k2kYQXMbZooiL5Juw=
+git.frostfs.info/TrueCloudLab/frostfs-sdk-go v0.0.0-20231003164722-60463871dbc2 h1:PHZX/Gh59ZPNG10JtTjBkmKbhKNq84CKu+dJpbzPVOc=
+git.frostfs.info/TrueCloudLab/frostfs-sdk-go v0.0.0-20231003164722-60463871dbc2/go.mod h1:t1akKcUH7iBrFHX8rSXScYMP17k2kYQXMbZooiL5Juw=
 git.frostfs.info/TrueCloudLab/hrw v1.2.1 h1:ccBRK21rFvY5R1WotI6LNoPlizk7qSvdfD8lNIRudVc=
 git.frostfs.info/TrueCloudLab/hrw v1.2.1/go.mod h1:C1Ygde2n843yTZEQ0FP69jYiuaYV0kriLvP4zm8JuvM=
-git.frostfs.info/TrueCloudLab/policy-engine v0.0.0-20240206111236-8354a074c4df h1:FLk850Ti+aj9vdJTUPvtS4KDIpISze9vTNKV15WIbME=
-git.frostfs.info/TrueCloudLab/policy-engine v0.0.0-20240206111236-8354a074c4df/go.mod h1:YVL7yFaT0QNSpA0z+RHudLvrLwT+lsFYGyBSVc1ustI=
 git.frostfs.info/TrueCloudLab/rfc6979 v0.4.0 h1:M2KR3iBj7WpY3hP10IevfIB9MURr4O9mwVfJ+SjT3HA=
 git.frostfs.info/TrueCloudLab/rfc6979 v0.4.0/go.mod h1:okpbKfVYf/BpejtfFTfhZqFP+sZ8rsHrP8Rr/jYPNRc=
 git.frostfs.info/TrueCloudLab/tzhash v1.8.0 h1:UFMnUIk0Zh17m8rjGHJMqku2hCgaXDqjqZzS4gsb4UA=
 git.frostfs.info/TrueCloudLab/tzhash v1.8.0/go.mod h1:dhY+oy274hV8wGvGL4MwwMpdL3GYvaX1a8GQZQHvlF8=
-git.frostfs.info/TrueCloudLab/zapjournald v0.0.0-20240124114243-cb2e66427d02 h1:HeY8n27VyPRQe49l/fzyVMkWEB2fsLJYKp64pwA7tz4=
-git.frostfs.info/TrueCloudLab/zapjournald v0.0.0-20240124114243-cb2e66427d02/go.mod h1:rQFJJdEOV7KbbMtQYR2lNfiZk+ONRDJSbMCTWxKt8Fw=
+git.frostfs.info/TrueCloudLab/zapjournald v0.0.0-20231018083019-2b6d84de9a3d h1:Z9UuI+jxzPtwQZUMmATdTuA8/8l2jzBY1rVh/gwBDsw=
+git.frostfs.info/TrueCloudLab/zapjournald v0.0.0-20231018083019-2b6d84de9a3d/go.mod h1:rQFJJdEOV7KbbMtQYR2lNfiZk+ONRDJSbMCTWxKt8Fw=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/CityOfZion/neo-go v0.62.1-pre.0.20191114145240-e740fbe708f8/go.mod h1:MJCkWUBhi9pn/CrYO1Q3P687y2KeahrOPS9BD9LDGb0=
+github.com/CityOfZion/neo-go v0.70.1-pre.0.20191209120015-fccb0085941e/go.mod h1:0enZl0az8xA6PVkwzEOwPWVJGqlt/GO4hA4kmQ5Xzig=
+github.com/CityOfZion/neo-go v0.70.1-pre.0.20191212173117-32ac01130d4c/go.mod h1:JtlHfeqLywZLswKIKFnAp+yzezY4Dji9qlfQKB2OD/I=
+github.com/CityOfZion/neo-go v0.71.1-pre.0.20200129171427-f773ec69fb84/go.mod h1:FLI526IrRWHmcsO+mHsCbj64pJZhwQFTLJZu+A4PGOA=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/Workiva/go-datastructures v1.0.50/go.mod h1:Z+F2Rca0qCsVYDS8z7bAGm8f3UkzuWYS/oBZz5a7VVA=
+github.com/abiosoft/ishell v2.0.0+incompatible/go.mod h1:HQR9AqF2R3P4XXpMpI0NAzgHf/aS6+zVXRj14cVk9qg=
+github.com/abiosoft/ishell/v2 v2.0.2/go.mod h1:E4oTCXfo6QjoCart0QYa5m9w4S+deXs/P/9jA77A9Bs=
+github.com/abiosoft/readline v0.0.0-20180607040430-155bce2042db/go.mod h1:rB3B4rKii8V21ydCbIzH5hZiCQE7f5E9SzUb/ZZx530=
+github.com/aead/siphash v1.0.1/go.mod h1:Nywa3cDsYNNK3gaciGTWPwHt0wlpNV15vwmswBAUSII=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
+github.com/alicebob/gopher-json v0.0.0-20180125190556-5a6b3ba71ee6/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
+github.com/alicebob/miniredis v2.5.0+incompatible/go.mod h1:8HZjEj4yU0dwhYHky+DxYx+6BMjkBbe5ONFIF1MXffk=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/antlr/antlr4/runtime/Go/antlr v0.0.0-20210521073959-f0d4d129b7f1/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY=
 github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
 github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
 github.com/aws/aws-sdk-go v1.44.6 h1:Y+uHxmZfhRTLX2X3khkdxCoTZAyGEX21aOUHe1U6geg=
 github.com/aws/aws-sdk-go v1.44.6/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
+github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
+github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bluele/gcache v0.0.2 h1:WcbfdXICg7G/DGBh1PFfcirkWOQV+v077yF1pSy3DGw=
 github.com/bluele/gcache v0.0.2/go.mod h1:m15KV+ECjptwSPxKhOhQoAFQVtUFjTVkc3H8o0t/fp0=
+github.com/btcsuite/btcd v0.20.1-beta/go.mod h1:wVuoA8VJLEcwgqHBwHmzLRazpKxTv13Px/pDuV7OomQ=
+github.com/btcsuite/btcd v0.22.0-beta/go.mod h1:9n5ntfhhHQBIhUvlhDvD3Qg6fRUj4jkN0VB8L8svzOA=
+github.com/btcsuite/btclog v0.0.0-20170628155309-84c8d2346e9f/go.mod h1:TdznJufoqS23FtqVCzL0ZqgP5MqXbb4fg/WgDys70nA=
+github.com/btcsuite/btcutil v0.0.0-20190425235716-9e5f4b9a998d/go.mod h1:+5NJ2+qvTyV9exUAL/rxXi3DcLg2Ts+ymUAY5y4NvMg=
+github.com/btcsuite/btcutil v1.0.3-0.20201208143702-a53e38424cce/go.mod h1:0DVlHczLPewLcPGEIeUEzfOJhqGPQ0mJJRDBtD307+o=
+github.com/btcsuite/go-socks v0.0.0-20170105172521-4720035b7bfd/go.mod h1:HHNXQzUsZCxOoE+CPiyCTO6x34Zs86zZUiwtpXoGdtg=
+github.com/btcsuite/goleveldb v0.0.0-20160330041536-7834afc9e8cd/go.mod h1:F+uVaaLLH7j4eDXPRvw78tMflu7Ie2bzYOH4Y8rRKBY=
+github.com/btcsuite/goleveldb v1.0.0/go.mod h1:QiK9vBlgftBg6rWQIj6wFzbPfRjiykIEhBH4obrXJ/I=
+github.com/btcsuite/snappy-go v0.0.0-20151229074030-0bdef8d06723/go.mod h1:8woku9dyThutzjeg+3xrA5iCpBRH8XEEg3lh6TiUghc=
+github.com/btcsuite/snappy-go v1.0.0/go.mod h1:8woku9dyThutzjeg+3xrA5iCpBRH8XEEg3lh6TiUghc=
+github.com/btcsuite/websocket v0.0.0-20150119174127-31079b680792/go.mod h1:ghJtEyQwv5/p4Mg4C0fgbePVuGr935/5ddU9Z3TmDRY=
+github.com/btcsuite/winsvc v1.0.0/go.mod h1:jsenWakMcC0zFBFurPLEAyrnc/teJEM1O46fmI40EZs=
 github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
 github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/cespare/xxhash/v2 v2.1.0/go.mod h1:dgIUBU3pDso/gPgZ1osOZ0iQf77oPR28Tjxl5dIMyVM=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
@@ -87,14 +120,18 @@ github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v0.0.0-20171005155431-ecdeabc65495/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 h1:8UrgZ3GkP4i/CLijOJx79Yu+etlyjdBU4sfcs2WYQMs=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
+github.com/decred/dcrd/lru v1.0.0/go.mod h1:mxKOwFd7lFjN2GZYsiz/ecgqR6kkYAl+0pz0tEMk218=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -103,7 +140,14 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/etcd-io/bbolt v1.3.3/go.mod h1:ZF2nL25h33cCyBtcyWeZ2/I3HQOfTP+0PIEvHjkjCrw=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/flynn-archive/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:rZfgFAXFS/z/lEd6LJmf9HVZ1LkgYiHx5pHhV5DR16M=
+github.com/frankban/quicktest v1.14.0/go.mod h1:NeW+ay9A/U67EYXNFA1nPE8e/tnQv/09mUdL/ijj8og=
 github.com/frankban/quicktest v1.14.5 h1:dfYrrRyLtiqT9GyKXgdh+k4inNeTvmGbuSgZ3lx3GhA=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -112,14 +156,26 @@ github.com/go-chi/chi/v5 v5.0.8/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITL
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+github.com/go-kit/log v0.2.0/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
 github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-redis/redis v6.10.2+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-yaml/yaml v2.1.0+incompatible/go.mod h1:w2MrLa16VYP0jy6N7M5kHaCkaLENm+P+Tv+MfurjSw0=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
-github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
+github.com/golang/glog v1.1.0 h1:/d3pCKDPWNnvIWe0vVUpNP32qc8U3PDVxySP/y360qE=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -130,6 +186,7 @@ github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
 github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
+github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -148,7 +205,11 @@ github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaS
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/snappy v0.0.1 h1:Qgr9rKW7uDUkrbSmQeiDsGa8SjGyCOGtuasMWwvp2P4=
+github.com/golang/snappy v0.0.0-20170215233205-553a64147049/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.3 h1:fHPg5GQYlCeLIPB9BZqMVR5nR9A+IM5zcgeTdjMYmLA=
+github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/gomodule/redigo v2.0.0+incompatible/go.mod h1:B4C85qUVwatsJoIUNIfCRsp7qO0iAmpGFZ4EELWSbC4=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -162,7 +223,9 @@ github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
@@ -178,49 +241,75 @@ github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
+github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
 github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 h1:BZHcxBETFHIdVyhyEfOvn/RdU/QGdLI4y34qQGjGWO0=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 h1:lLT7ZLSzGLI08vc9cpd+tYmNWjdKDqyr/2L+f6U12Fk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/golang-lru v0.6.0 h1:uL2shRDx7RTrOrTCUZEGP/wJUFiUI8QT6E7z5o8jga4=
 github.com/hashicorp/golang-lru v0.6.0/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/golang-lru/v2 v2.0.2 h1:Dwmkdr5Nc/oBiXgJS3CDHNhJtIHkuZ3DZF5twqnfBdU=
 github.com/hashicorp/golang-lru/v2 v2.0.2/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/holiman/uint256 v1.2.0/go.mod h1:y4ga/t+u+Xwd7CpDgZESaRcWy0I7XMlTMA25ApIH5Jw=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jessevdk/go-flags v0.0.0-20141203071132-1679536dcc89/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
+github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
-github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
+github.com/jrick/logrotate v1.0.0/go.mod h1:LNinyqDIJnpAur+b8yyulnQw/wDuN1+BYKlTRt3OuAQ=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
+github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kkdai/bstream v0.0.0-20161212061736-f391b8402d23/go.mod h1:J+Gs4SYgM6CZQHDETBtE9HaSEkGmuNXF86RwHhHUvq4=
 github.com/klauspost/compress v1.13.4 h1:0zhec2I8zGnjWcKyLl6i3gPqKANCCn5e9xmviEEeX6s=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
+github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
 github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/minio/highwayhash v1.0.1 h1:dZ6IIu8Z14VlC0VpfKofAhCy74wu/Qb5gcn52yWoz/0=
@@ -228,8 +317,16 @@ github.com/minio/sio v0.3.0 h1:syEFBewzOMOYVzSTFpp1MqpSZk8rUNbz8VIIc+PNzus=
 github.com/minio/sio v0.3.0/go.mod h1:8b0yPp2avGThviy/+OCJBI6OMpvxoUuiLvE6F1lebhw=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/mr-tron/base58 v1.1.2/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
 github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
 github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/nats-io/jwt/v2 v2.2.1-0.20220113022732-58e87895b296 h1:vU9tpM3apjYlLLeY23zRWJ9Zktr5jp+mloR942LEOpY=
 github.com/nats-io/nats-server/v2 v2.7.1 h1:SDj8R0PJPVekw3EgHxGtTfJUuMbsuaul1nwWFI3xTyk=
 github.com/nats-io/nats-server/v2 v2.7.1/go.mod h1:tckmrt0M6bVaDT3kmh9UrIq/CBOBBse+TpXQi5ldaa8=
@@ -239,39 +336,103 @@ github.com/nats-io/nkeys v0.3.0 h1:cgM5tL53EvYRU+2YLXIK0G2mJtK12Ft9oeooSZMA2G8=
 github.com/nats-io/nkeys v0.3.0/go.mod h1:gvUNGjVcM2IPr5rCsRsC6Wb3Hr2CQAm08dsxtV6A5y4=
 github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
 github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
-github.com/nspcc-dev/go-ordered-json v0.0.0-20231123160306-3374ff1e7a3c h1:OOQeE613BH93ICPq3eke5N78gWNeMjcBWkmD2NKyXVg=
-github.com/nspcc-dev/go-ordered-json v0.0.0-20231123160306-3374ff1e7a3c/go.mod h1:79bEUDEviBHJMFV6Iq6in57FEOCMcRhfQnfaf0ETA5U=
-github.com/nspcc-dev/neo-go v0.104.1-0.20231206061802-441eb8aa86be h1:nZ2Hi5JSXdq3JXDi/8lms1UXQDAA5LVGpOpcrf2bRVA=
-github.com/nspcc-dev/neo-go v0.104.1-0.20231206061802-441eb8aa86be/go.mod h1:dsu8+VDMgGF7QNtPFBU4seE3pxSq8fYCuk3A6he4+ZQ=
-github.com/nspcc-dev/neo-go/pkg/interop v0.0.0-20231127165613-b35f351f0ba0 h1:N+dMIBmteXjJpkH6UZ7HmNftuFxkqszfGLbhsEctnv0=
-github.com/nspcc-dev/neo-go/pkg/interop v0.0.0-20231127165613-b35f351f0ba0/go.mod h1:J/Mk6+nKeKSW4wygkZQFLQ6SkLOSGX5Ga0RuuuktEag=
+github.com/nspcc-dev/dbft v0.0.0-20191205084618-dacb1a30c254/go.mod h1:w1Ln2aT+dBlPhLnuZhBV+DfPEdS2CHWWLp5JTScY3bw=
+github.com/nspcc-dev/dbft v0.0.0-20191209120240-0d6b7568d9ae/go.mod h1:3FjXOoHmA51EGfb5GS/HOv7VdmngNRTssSeQ729dvGY=
+github.com/nspcc-dev/dbft v0.0.0-20200117124306-478e5cfbf03a/go.mod h1:/YFK+XOxxg0Bfm6P92lY5eDSLYfp06XOdL8KAVgXjVk=
+github.com/nspcc-dev/dbft v0.0.0-20200219114139-199d286ed6c1/go.mod h1:O0qtn62prQSqizzoagHmuuKoz8QMkU3SzBoKdEvm3aQ=
+github.com/nspcc-dev/dbft v0.0.0-20210721160347-1b03241391ac/go.mod h1:U8MSnEShH+o5hexfWJdze6uMFJteP0ko7J2frO7Yu1Y=
+github.com/nspcc-dev/dbft v0.0.0-20220902113116-58a5e763e647/go.mod h1:g9xisXmX9NP9MjioaTe862n9SlZTrP+6PVUWLBYOr98=
+github.com/nspcc-dev/go-ordered-json v0.0.0-20210915112629-e1b6cce73d02/go.mod h1:79bEUDEviBHJMFV6Iq6in57FEOCMcRhfQnfaf0ETA5U=
+github.com/nspcc-dev/go-ordered-json v0.0.0-20220111165707-25110be27d22 h1:n4ZaFCKt1pQJd7PXoMJabZWK9ejjbLOVrkl/lOUmshg=
+github.com/nspcc-dev/go-ordered-json v0.0.0-20220111165707-25110be27d22/go.mod h1:79bEUDEviBHJMFV6Iq6in57FEOCMcRhfQnfaf0ETA5U=
+github.com/nspcc-dev/hrw v1.0.9/go.mod h1:l/W2vx83vMQo6aStyx2AuZrJ+07lGv2JQGlVkPG06MU=
+github.com/nspcc-dev/neo-go v0.73.1-pre.0.20200303142215-f5a1b928ce09/go.mod h1:pPYwPZ2ks+uMnlRLUyXOpLieaDQSEaf4NM3zHVbRjmg=
+github.com/nspcc-dev/neo-go v0.98.0/go.mod h1:E3cc1x6RXSXrJb2nDWXTXjnXk3rIqVN8YdFyWv+FrqM=
+github.com/nspcc-dev/neo-go v0.99.4/go.mod h1:mKTolfRUfKjFso5HPvGSQtUZc70n0VKBMs16eGuC5gA=
+github.com/nspcc-dev/neo-go v0.101.2-0.20230601131642-a0117042e8fc h1:fySIWvUQsitK5e5qYIHnTDCXuPpwzz89SEUEIyY11sg=
+github.com/nspcc-dev/neo-go v0.101.2-0.20230601131642-a0117042e8fc/go.mod h1:s9QhjMC784MWqTURovMbyYduIJc86mnCruxcMiAebpc=
+github.com/nspcc-dev/neo-go/pkg/interop v0.0.0-20220927123257-24c107e3a262/go.mod h1:23bBw0v6pBYcrWs8CBEEDIEDJNbcFoIh8pGGcf2Vv8s=
+github.com/nspcc-dev/neo-go/pkg/interop v0.0.0-20230615193820-9185820289ce h1:vLGuUNDkmQrWMa4rr4vTd1u8ULqejWxVmNz1L7ocTEI=
+github.com/nspcc-dev/neo-go/pkg/interop v0.0.0-20230615193820-9185820289ce/go.mod h1:ZUuXOkdtHZgaC13za/zMgXfQFncZ0jLzfQTe+OsDOtg=
+github.com/nspcc-dev/neofs-api-go/v2 v2.11.0-pre.0.20211201134523-3604d96f3fe1/go.mod h1:oS8dycEh8PPf2Jjp6+8dlwWyEv2Dy77h/XhhcdxYEFs=
+github.com/nspcc-dev/neofs-api-go/v2 v2.11.1/go.mod h1:oS8dycEh8PPf2Jjp6+8dlwWyEv2Dy77h/XhhcdxYEFs=
+github.com/nspcc-dev/neofs-crypto v0.2.0/go.mod h1:F/96fUzPM3wR+UGsPi3faVNmFlA9KAEAUQR7dMxZmNA=
+github.com/nspcc-dev/neofs-crypto v0.2.3/go.mod h1:8w16GEJbH6791ktVqHN9YRNH3s9BEEKYxGhlFnp0cDw=
+github.com/nspcc-dev/neofs-crypto v0.3.0/go.mod h1:8w16GEJbH6791ktVqHN9YRNH3s9BEEKYxGhlFnp0cDw=
+github.com/nspcc-dev/neofs-crypto v0.4.0/go.mod h1:6XJ8kbXgOfevbI2WMruOtI+qUJXNwSGM/E9eClXxPHs=
+github.com/nspcc-dev/neofs-sdk-go v0.0.0-20211201182451-a5b61c4f6477/go.mod h1:dfMtQWmBHYpl9Dez23TGtIUKiFvCIxUZq/CkSIhEpz4=
+github.com/nspcc-dev/neofs-sdk-go v0.0.0-20220113123743-7f3162110659/go.mod h1:/jay1lr3w7NQd/VDBkEhkJmDmyPNsu4W+QV2obsUV40=
+github.com/nspcc-dev/rfc6979 v0.1.0/go.mod h1:exhIh1PdpDC5vQmyEsGvc4YDM/lyQp/452QxGq/UEso=
 github.com/nspcc-dev/rfc6979 v0.2.0 h1:3e1WNxrN60/6N0DW7+UYisLeZJyfqZTNOjeV/toYvOE=
 github.com/nspcc-dev/rfc6979 v0.2.0/go.mod h1:exhIh1PdpDC5vQmyEsGvc4YDM/lyQp/452QxGq/UEso=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
+github.com/onsi/gomega v1.4.1/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
+github.com/onsi/gomega v1.4.2/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
 github.com/panjf2000/ants/v2 v2.5.0 h1:1rWGWSnxCsQBga+nQbA4/iY6VMeNoOIAM0ZWh9u3q2Q=
 github.com/panjf2000/ants/v2 v2.5.0/go.mod h1:cU93usDlihJZ5CfRGNDYsiBYvoilLvBF5Qp/BT2GNRE=
 github.com/pelletier/go-toml/v2 v2.0.6 h1:nrzqCb7j9cDFj2coyLNLaZuJTLjWjlaz6nvTvIwycIU=
 github.com/pelletier/go-toml/v2 v2.0.6/go.mod h1:eumQOmlWiOPt5WriQQqoM5y18pDHwha2N+QD+EUNTek=
+github.com/pierrec/lz4 v2.6.1+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
+github.com/prometheus/client_golang v1.2.1/go.mod h1:XMU6Z2MjaRKVu/dC1qupJI9SiNkDYzz3xecMgSW/F+U=
+github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
+github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
+github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
+github.com/prometheus/client_golang v1.13.0/go.mod h1:vTeo+zgvILHsnnj/39Ou/1fPN5nJFOEMgftOUOmlvYQ=
 github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI=
 github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4=
 github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
+github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.7.0/go.mod h1:DjGbpBbp5NYNiECxcL/VnbXCCaQpKd3tt26CguLLsqA=
+github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
+github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
+github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
+github.com/prometheus/common v0.37.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
 github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
 github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.0.5/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
+github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
+github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
 github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
 github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
+github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.9.3 h1:41FoI0fD7OR7mGcKE/aOiLkGreyf8ifIOQmJANWogMk=
 github.com/spf13/afero v1.9.3/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
@@ -287,22 +448,28 @@ github.com/spf13/viper v1.15.0/go.mod h1:fFcTBJxvhhzSJiZy8n+PeW6t8l+KeT/uTARa0jH
 github.com/ssgreg/journald v1.0.0 h1:0YmTDPJXxcWDPba12qNMdO6TxvfkFSYpFIJ31CwmLcU=
 github.com/ssgreg/journald v1.0.0/go.mod h1:RUckwmTM8ghGWPslq2+ZBZzbb9/2KgjzYZ4JEP+oRt0=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
+github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
 github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
+github.com/syndtr/goleveldb v0.0.0-20180307113352-169b1b37be73/go.mod h1:Z4AUp2Km+PwemOoO/VB5AOx9XSsIItzFjoJlOSiYmn0=
 github.com/syndtr/goleveldb v1.0.1-0.20210305035536-64b5b1c73954 h1:xQdMZ1WLrgkkvOZ/LDQxjVxMLdby7osSh4ZEVa5sIjs=
+github.com/syndtr/goleveldb v1.0.1-0.20210305035536-64b5b1c73954/go.mod h1:u2MKkTVTVJWe5D1rCvame8WqhBd88EuIwODJZ1VHCPM=
+github.com/twmb/murmur3 v1.1.5/go.mod h1:Qq/R7NUyOfr65zD+6Q5IHKsJLwP7exErjN6lyyq3OSQ=
 github.com/twmb/murmur3 v1.1.8 h1:8Yt9taO/WN3l08xErzjeschgZU2QSrwm1kclYq+0aRg=
 github.com/twmb/murmur3 v1.1.8/go.mod h1:Qq/R7NUyOfr65zD+6Q5IHKsJLwP7exErjN6lyyq3OSQ=
+github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/urfave/cli v1.22.5 h1:lNq9sAHXK2qfdI8W+GRItjCEkI+2oR4d+MEHy1CKXoU=
 github.com/urfave/cli v1.22.5/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli/v2 v2.3.0 h1:qph92Y649prgesehzOrQjdWyxFOp/QVM+6imKHad91M=
@@ -313,7 +480,12 @@ github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.etcd.io/bbolt v1.3.8 h1:xs88BrvEv273UsB79e0hcVrlUWmS0a8upikMFhSyAtA=
+github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/gopher-lua v0.0.0-20190514113301-1cd887cd7036/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=
+github.com/yuin/gopher-lua v0.0.0-20191128022950-c6266f4fe8d7/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=
+go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
+go.etcd.io/bbolt v1.3.6 h1:/ecaJf0sk1l4l6V4awd65v2C3ILy7MSj+s/x1ADCIMU=
+go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -339,22 +511,38 @@ go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLk
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v0.19.0 h1:IVN6GR+mhC4s5yfcTbmzHYODqvWAp3ZedA2SJPI1Nnw=
 go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
+go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
-go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
+go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
+golang.org/x/crypto v0.0.0-20170930174604-9419663f5a44/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190513172903-22d7a77e9e5f/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200115085410-6d4e4cb37c7d/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210314154223-e6e6c4f2bb5b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
+golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g=
+golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -365,8 +553,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63 h1:m64FZMko/V45gv0bNmrNYoDEq8U5YUhetc9cBWKS1TQ=
-golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63/go.mod h1:0v4NqG35kSWCMzLaMeX+IQrlSnVE/bqGSyC2cz/9Le8=
+golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc h1:mCRnTeVUjcrhlRmO0VK8a6k6Rrf6TF9htwo2pJVSjIU=
+golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -390,8 +578,12 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
+golang.org/x/net v0.0.0-20180719180050-a680a1efc54d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -399,6 +591,7 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -412,9 +605,11 @@ golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200813134508-3edf25e44fcc/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
@@ -422,9 +617,12 @@ golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -434,7 +632,9 @@ golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -446,21 +646,36 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
+golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191010194322-b09406accb47/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -471,28 +686,39 @@ golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200814200057-3d37ad5750ed/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210429154555-c04ba851c2a4/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
+golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -500,13 +726,15 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.1.0 h1:xYY+Bajn2a7VBmTM5GikTmnK8ZuX8YgnQCqZpbBNtmA=
+golang.org/x/tools v0.0.0-20180318012157-96caea41033d/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -522,6 +750,7 @@ golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgw
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -548,12 +777,14 @@ golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
+golang.org/x/tools v0.0.0-20201022035929-9cf592e881e9/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
+golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -622,12 +853,8 @@ google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f h1:Vn+VyHU5guc9KjB5KrjI2q0wCOWEOIh0OEsleqakHJg=
-google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f/go.mod h1:nWSwAFPb+qfNJXsoeO3Io7zf4tMSfN8EA8RlDA04GhY=
-google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 h1:JpwMPBpFN3uKhdaekDpiNlImDdkUAyiJ6ez/uxGaUSo=
-google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:0xJLfVdJqpAPl8tDg1ujOCGzx6LFLttXT5NhllGOXY4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4 h1:DC7wcm+i+P1rN3Ff07vL+OndGg5OhNddHyTA+ocPqYE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4/go.mod h1:eJVxU6o+4G1PSczBr85xmyvSNYAKvAYgkub40YGomFM=
+google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A=
+google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -647,9 +874,10 @@ google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA5
 google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc v1.41.0/go.mod h1:U3l9uK9J0sini8mHphKoXyaqDA/8VyGnDee1zzIUK6k=
 google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
-google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
+google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
+google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -663,18 +891,29 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
+google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+gopkg.in/abiosoft/ishell.v2 v2.0.0/go.mod h1:sFp+cGtH6o4s1FtpVPTMcHq2yue+c4DGOVohJCPUzwY=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

internal/frostfs/authmate.go

@@ -120,11 +120,6 @@ func (x *AuthmateFrostFS) CreateObject(ctx context.Context, prm tokens.PrmObject
 		attributes = append(attributes, [2]string{accessBoxCRDTNameAttr, versions.Name()})
 	}
 
-	for _, attr := range prm.CustomAttributes {
-		// we don't check attribute duplication since storage node does this
-		attributes = append(attributes, [2]string{attr.Key(), attr.Value()})
-	}
-
 	return x.frostFS.CreateObject(ctx, layer.PrmObjectCreate{
 		Container:  prm.Container,
 		Filepath:   prm.Filepath,

internal/frostfs/frostfs.go

@@ -126,7 +126,6 @@ func (x *FrostFS) CreateContainer(ctx context.Context, prm layer.PrmContainerCre
 	if prm.Name != "" {
 		var d container.Domain
 		d.SetName(prm.Name)
-		d.SetZone(prm.Zone)
 
 		container.WriteDomain(&cnr, d)
 		container.SetName(&cnr, prm.Name)

internal/frostfs/frostfsid/frostfsid.go

@@ -1,118 +0,0 @@
-package frostfsid
-
-import (
-	"context"
-	"fmt"
-	"strconv"
-	"strings"
-
-	"git.frostfs.info/TrueCloudLab/frostfs-contract/frostfsid/client"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/handler"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/authmate"
-	frostfsutil "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs/util"
-	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
-	"github.com/nspcc-dev/neo-go/pkg/rpcclient"
-	"github.com/nspcc-dev/neo-go/pkg/util"
-	"github.com/nspcc-dev/neo-go/pkg/wallet"
-)
-
-type FrostFSID struct {
-	cli *client.Client
-}
-
-type Config struct {
-	// RPCAddress is an endpoint to connect to neo rpc.
-	RPCAddress string
-
-	// Contract is hash of contract or its name in NNS.
-	Contract string
-
-	// ProxyContract is hash of proxy contract or its name in NNS to interact with frostfsid.
-	ProxyContract string
-
-	// Key is used to interact with frostfsid contract.
-	// If this is nil than random key will be generated.
-	Key *keys.PrivateKey
-}
-
-var (
-	_ api.FrostFSID      = (*FrostFSID)(nil)
-	_ authmate.FrostFSID = (*FrostFSID)(nil)
-	_ handler.FrostFSID  = (*FrostFSID)(nil)
-)
-
-// New creates new FrostfsID contract wrapper that implements auth.FrostFSID interface.
-func New(ctx context.Context, cfg Config) (*FrostFSID, error) {
-	contractHash, err := frostfsutil.ResolveContractHash(cfg.Contract, cfg.RPCAddress)
-	if err != nil {
-		return nil, fmt.Errorf("resolve frostfs contract hash: %w", err)
-	}
-
-	key := cfg.Key
-	if key == nil {
-		if key, err = keys.NewPrivateKey(); err != nil {
-			return nil, fmt.Errorf("generate anon private key for frostfsid: %w", err)
-		}
-	}
-
-	rpcCli, err := rpcclient.New(ctx, cfg.RPCAddress, rpcclient.Options{})
-	if err != nil {
-		return nil, fmt.Errorf("init rpc client: %w", err)
-	}
-
-	var opt client.Options
-	opt.ProxyContract, err = frostfsutil.ResolveContractHash(cfg.ProxyContract, cfg.RPCAddress)
-	if err != nil {
-		return nil, fmt.Errorf("resolve frostfs contract hash: %w", err)
-	}
-
-	cli, err := client.New(rpcCli, wallet.NewAccountFromPrivateKey(key), contractHash, opt)
-	if err != nil {
-		return nil, fmt.Errorf("init frostfsid client: %w", err)
-	}
-
-	return &FrostFSID{
-		cli: cli,
-	}, nil
-}
-
-func (f *FrostFSID) ValidatePublicKey(key *keys.PublicKey) error {
-	_, err := f.cli.GetSubjectByKey(key)
-	return err
-}
-
-func (f *FrostFSID) RegisterPublicKey(ns string, key *keys.PublicKey) error {
-	_, err := f.cli.Wait(f.cli.CreateSubject(ns, key))
-	if err != nil && !strings.Contains(err.Error(), "subject already exists") {
-		return err
-	}
-
-	return nil
-}
-
-func (f *FrostFSID) GetUserAddress(namespace, name string) (string, error) {
-	key, err := f.cli.GetSubjectKeyByName(namespace, name)
-	if err != nil {
-		return "", err
-	}
-
-	return key.Address(), nil
-}
-
-func (f *FrostFSID) GetUserGroupIDs(userHash util.Uint160) ([]string, error) {
-	subjExt, err := f.cli.GetSubjectExtended(userHash)
-	if err != nil {
-		if strings.Contains(err.Error(), "not found") {
-			return nil, nil
-		}
-		return nil, err
-	}
-
-	res := make([]string, len(subjExt.Groups))
-	for i, group := range subjExt.Groups {
-		res[i] = strconv.FormatInt(group.ID, 10)
-	}
-
-	return res, nil
-}

internal/frostfs/policy/contract/contract.go

@@ -1,132 +0,0 @@
-package contract
-
-import (
-	"context"
-	"fmt"
-	"math/big"
-
-	policycontract "git.frostfs.info/TrueCloudLab/frostfs-contract/policy"
-	policyclient "git.frostfs.info/TrueCloudLab/frostfs-contract/rpcclient/policy"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs/policy"
-	frostfsutil "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs/util"
-	"github.com/nspcc-dev/neo-go/pkg/core/transaction"
-	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
-	"github.com/nspcc-dev/neo-go/pkg/rpcclient"
-	"github.com/nspcc-dev/neo-go/pkg/rpcclient/actor"
-	"github.com/nspcc-dev/neo-go/pkg/rpcclient/notary"
-	"github.com/nspcc-dev/neo-go/pkg/util"
-	"github.com/nspcc-dev/neo-go/pkg/wallet"
-)
-
-type Client struct {
-	actor          *actor.Actor
-	policyContract *policyclient.Contract
-}
-
-type Config struct {
-	// RPCAddress is an endpoint to connect to neo rpc.
-	RPCAddress string
-
-	// Contract is hash of contract or its name in NNS.
-	Contract string
-
-	// ProxyContract is hash of proxy contract or its name in NNS to interact with policy.
-	ProxyContract string
-
-	// Key is used to interact with policy contract.
-	// If this is nil than random key will be generated.
-	Key *keys.PrivateKey
-}
-
-var _ policy.Contract = (*Client)(nil)
-
-// New creates new Policy contract wrapper.
-func New(ctx context.Context, cfg Config) (*Client, error) {
-	contractHash, err := frostfsutil.ResolveContractHash(cfg.Contract, cfg.RPCAddress)
-	if err != nil {
-		return nil, fmt.Errorf("resolve frostfs contract hash: %w", err)
-	}
-
-	key := cfg.Key
-	if key == nil {
-		if key, err = keys.NewPrivateKey(); err != nil {
-			return nil, fmt.Errorf("generate anon private key for policy: %w", err)
-		}
-	}
-
-	rpcCli, err := rpcclient.New(ctx, cfg.RPCAddress, rpcclient.Options{})
-	if err != nil {
-		return nil, fmt.Errorf("create policy rpc client: %w", err)
-	}
-
-	proxyContractHash, err := frostfsutil.ResolveContractHash(cfg.ProxyContract, cfg.RPCAddress)
-	if err != nil {
-		return nil, fmt.Errorf("resolve frostfs contract hash: %w", err)
-	}
-
-	act, err := actor.New(rpcCli, getSigners(key, proxyContractHash, contractHash))
-	if err != nil {
-		return nil, fmt.Errorf("create new actor: %w", err)
-	}
-
-	return &Client{
-		actor:          act,
-		policyContract: policyclient.New(act, contractHash),
-	}, nil
-}
-
-func getSigners(key *keys.PrivateKey, proxyHash, contractHash util.Uint160) []actor.SignerAccount {
-	acc := wallet.NewAccountFromPrivateKey(key)
-
-	return []actor.SignerAccount{
-		{
-			Signer: transaction.Signer{
-				Account:          proxyHash,
-				Scopes:           transaction.CustomContracts,
-				AllowedContracts: []util.Uint160{contractHash},
-			},
-			Account: notary.FakeContractAccount(proxyHash),
-		},
-		{
-			Signer: transaction.Signer{
-				Account: acc.Contract.ScriptHash(),
-				Scopes:  transaction.CalledByEntry,
-			},
-			Account: acc,
-		},
-	}
-}
-
-func (c *Client) AddChain(kind policycontract.Kind, entity string, name []byte, chain []byte) (util.Uint256, uint32, error) {
-	return c.policyContract.AddChain(big.NewInt(int64(kind)), entity, name, chain)
-}
-
-func (c *Client) GetChain(kind policycontract.Kind, entity string, name []byte) ([]byte, error) {
-	return c.policyContract.GetChain(big.NewInt(int64(kind)), entity, name)
-}
-
-func (c *Client) RemoveChain(kind policycontract.Kind, entity string, name []byte) (util.Uint256, uint32, error) {
-	return c.policyContract.RemoveChain(big.NewInt(int64(kind)), entity, name)
-}
-
-func (c *Client) ListChains(kind policycontract.Kind, entity string, name []byte) ([][]byte, error) {
-	items, err := c.policyContract.ListChainsByPrefix(big.NewInt(int64(kind)), entity, name)
-	if err != nil {
-		return nil, err
-	}
-
-	res := make([][]byte, len(items))
-	for i, item := range items {
-		res[i], err = item.TryBytes()
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	return res, nil
-}
-
-func (c *Client) Wait(tx util.Uint256, vub uint32, err error) error {
-	_, err = c.actor.Wait(tx, vub, err)
-	return err
-}

internal/frostfs/policy/contract/inmemory.go

@@ -1,97 +0,0 @@
-package contract
-
-import (
-	"errors"
-	"strings"
-	"sync"
-
-	policycontract "git.frostfs.info/TrueCloudLab/frostfs-contract/policy"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/frostfs/policy"
-	"github.com/nspcc-dev/neo-go/pkg/util"
-)
-
-type InMemoryContract struct {
-	iamChains       *syncedMap
-	containerChains *syncedMap
-	namespaceChains *syncedMap
-}
-
-type syncedMap struct {
-	mu   sync.RWMutex
-	data map[string][]byte
-}
-
-var _ policy.Contract = (*InMemoryContract)(nil)
-
-var ErrChainNotFound = errors.New("chain not found")
-
-// NewInMemoryContract creates new inmemory Policy contract wrapper.
-func NewInMemoryContract() *InMemoryContract {
-	return &InMemoryContract{
-		iamChains:       &syncedMap{data: map[string][]byte{}},
-		containerChains: &syncedMap{data: map[string][]byte{}},
-		namespaceChains: &syncedMap{data: map[string][]byte{}},
-	}
-}
-
-func (c *InMemoryContract) AddChain(kind policycontract.Kind, entity string, name []byte, chain []byte) (util.Uint256, uint32, error) {
-	syncMap := c.getMap(kind)
-	syncMap.mu.Lock()
-	syncMap.data[entity+string(name)] = chain
-	syncMap.mu.Unlock()
-
-	return util.Uint256{}, 0, nil
-}
-
-func (c *InMemoryContract) GetChain(kind policycontract.Kind, entity string, name []byte) ([]byte, error) {
-	syncMap := c.getMap(kind)
-	syncMap.mu.RLock()
-	defer syncMap.mu.RUnlock()
-
-	val, ok := syncMap.data[entity+string(name)]
-	if !ok {
-		return nil, ErrChainNotFound
-	}
-	return val, nil
-}
-
-func (c *InMemoryContract) RemoveChain(kind policycontract.Kind, entity string, name []byte) (util.Uint256, uint32, error) {
-	syncMap := c.getMap(kind)
-	syncMap.mu.Lock()
-	delete(syncMap.data, entity+string(name))
-	syncMap.mu.Unlock()
-
-	return util.Uint256{}, 0, nil
-}
-
-func (c *InMemoryContract) ListChains(kind policycontract.Kind, entity string, name []byte) ([][]byte, error) {
-	syncMap := c.getMap(kind)
-	syncMap.mu.RLock()
-	defer syncMap.mu.RUnlock()
-
-	var res [][]byte
-	for key, val := range syncMap.data {
-		if strings.HasPrefix(key, entity+string(name)) {
-			res = append(res, val)
-		}
-	}
-
-	return res, nil
-}
-
-func (c *InMemoryContract) Wait(_ util.Uint256, _ uint32, err error) error {
-	return err
-}
-
-func (c *InMemoryContract) getMap(kind policycontract.Kind) *syncedMap {
-	switch kind {
-	case policycontract.IAM:
-		return c.iamChains
-	case policycontract.Container:
-		return c.containerChains
-	case policycontract.Namespace:
-		return c.namespaceChains
-	default:
-		return &syncedMap{data: map[string][]byte{}}
-	}
-}

internal/frostfs/policy/morph_policy_storage.go

@@ -1,46 +0,0 @@
-package policy
-
-import (
-	policycontract "git.frostfs.info/TrueCloudLab/frostfs-contract/policy"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/handler"
-	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
-	"go.uber.org/zap"
-)
-
-type MorphPolicyStorage struct {
-	contract Contract
-}
-
-type MorphPolicyStorageConfig struct {
-	Contract Contract
-	Log      *zap.Logger
-}
-
-var _ handler.PolicyStorage = (*MorphPolicyStorage)(nil)
-
-const policyStoragePrefix = 'b'
-
-func NewMorphPolicyStorage(config *MorphPolicyStorageConfig) *MorphPolicyStorage {
-	return &MorphPolicyStorage{
-		contract: config.Contract,
-	}
-}
-
-func (c *MorphPolicyStorage) PutPolicy(namespace string, cnrID cid.ID, policy []byte) error {
-	name := getPolicyStorageName(cnrID)
-	return c.contract.Wait(c.contract.AddChain(policycontract.IAM, namespace, name, policy))
-}
-
-func (c *MorphPolicyStorage) GetPolicy(namespace string, cnrID cid.ID) ([]byte, error) {
-	name := getPolicyStorageName(cnrID)
-	return c.contract.GetChain(policycontract.IAM, namespace, name)
-}
-
-func (c *MorphPolicyStorage) DeletePolicy(namespace string, cnrID cid.ID) error {
-	name := getPolicyStorageName(cnrID)
-	return c.contract.Wait(c.contract.RemoveChain(policycontract.IAM, namespace, name))
-}
-
-func getPolicyStorageName(cnrID cid.ID) []byte {
-	return append([]byte{policyStoragePrefix}, cnrID[:]...)
-}

internal/frostfs/policy/morph_rule_chain_storage.go

@@ -1,101 +0,0 @@
-package policy
-
-import (
-	"fmt"
-
-	policycontract "git.frostfs.info/TrueCloudLab/frostfs-contract/policy"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/cache"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/handler"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
-	"github.com/nspcc-dev/neo-go/pkg/util"
-	"go.uber.org/zap"
-)
-
-type MorphRuleChainStorage struct {
-	contract Contract
-	cache    *cache.MorphPolicyCache
-	log      *zap.Logger
-}
-
-type MorphRuleChainStorageConfig struct {
-	Contract Contract
-	Cache    *cache.MorphPolicyCache
-	Log      *zap.Logger
-}
-
-var (
-	_ engine.MorphRuleChainStorage  = (*MorphRuleChainStorage)(nil)
-	_ handler.MorphRuleChainStorage = (*MorphRuleChainStorage)(nil)
-)
-
-func NewMorphRuleChainStorage(config *MorphRuleChainStorageConfig) *MorphRuleChainStorage {
-	return &MorphRuleChainStorage{
-		contract: config.Contract,
-		cache:    config.Cache,
-		log:      config.Log,
-	}
-}
-
-func (c *MorphRuleChainStorage) AddChain(target engine.Target, policyChain *chain.Chain) error {
-	return c.contract.Wait(c.AddMorphRuleChain(chain.S3, target, policyChain))
-}
-
-func (c *MorphRuleChainStorage) RemoveChain(target engine.Target, chainID chain.ID) error {
-	return c.contract.Wait(c.RemoveMorphRuleChain(chain.S3, target, chainID))
-}
-
-func (c *MorphRuleChainStorage) ListChains(target engine.Target) ([]*chain.Chain, error) {
-	return c.ListMorphRuleChains(chain.S3, target)
-}
-
-func (c *MorphRuleChainStorage) AddMorphRuleChain(name chain.Name, target engine.Target, policyChain *chain.Chain) (util.Uint256, uint32, error) {
-	c.cache.Delete(cache.MorphPolicyCacheKey{Target: target, Name: name})
-	return c.contract.AddChain(getKind(target), target.Name, getName(name, policyChain.ID), policyChain.Bytes())
-}
-
-func (c *MorphRuleChainStorage) RemoveMorphRuleChain(name chain.Name, target engine.Target, chainID chain.ID) (util.Uint256, uint32, error) {
-	c.cache.Delete(cache.MorphPolicyCacheKey{Target: target, Name: name})
-	return c.contract.RemoveChain(getKind(target), target.Name, getName(name, chainID))
-}
-
-func (c *MorphRuleChainStorage) ListMorphRuleChains(name chain.Name, target engine.Target) ([]*chain.Chain, error) {
-	key := cache.MorphPolicyCacheKey{Target: target, Name: name}
-	list := c.cache.Get(key)
-	if list != nil {
-		return list, nil
-	}
-
-	listChains, err := c.contract.ListChains(getKind(target), target.Name, []byte(name))
-	if err != nil {
-		return nil, err
-	}
-
-	list = make([]*chain.Chain, len(listChains))
-	for i, listChain := range listChains {
-		var item chain.Chain
-		if err = item.DecodeBytes(listChain); err != nil {
-			return nil, fmt.Errorf("unmarshal chain: %w", err)
-		}
-		list[i] = &item
-	}
-
-	if err = c.cache.Put(key, list); err != nil {
-		c.log.Warn(logs.CouldntCacheListPolicyChains)
-	}
-
-	return list, nil
-}
-
-func getKind(target engine.Target) policycontract.Kind {
-	var kind policycontract.Kind = policycontract.Container
-	if target.Type != engine.Container {
-		kind = policycontract.Namespace
-	}
-
-	return kind
-}
-func getName(name chain.Name, chainID chain.ID) []byte {
-	return append([]byte(name), []byte(chainID)...)
-}

internal/frostfs/policy/storage.go

@@ -1,95 +0,0 @@
-package policy
-
-import (
-	policycontract "git.frostfs.info/TrueCloudLab/frostfs-contract/policy"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/cache"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/handler"
-	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine/inmemory"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/resource"
-	"github.com/nspcc-dev/neo-go/pkg/util"
-	"go.uber.org/zap"
-)
-
-type Storage struct {
-	router engine.ChainRouter
-
-	morph handler.MorphRuleChainStorage
-
-	local engine.LocalOverrideStorage
-
-	policy handler.PolicyStorage
-}
-
-type StorageConfig struct {
-	Contract Contract
-	Cache    *cache.MorphPolicyCache
-	Log      *zap.Logger
-}
-
-type Contract interface {
-	AddChain(kind policycontract.Kind, entity string, name []byte, chain []byte) (util.Uint256, uint32, error)
-	GetChain(kind policycontract.Kind, entity string, name []byte) ([]byte, error)
-	RemoveChain(kind policycontract.Kind, entity string, name []byte) (util.Uint256, uint32, error)
-	ListChains(kind policycontract.Kind, entity string, name []byte) ([][]byte, error)
-	Wait(tx util.Uint256, vub uint32, err error) error
-}
-
-var _ handler.APE = (*Storage)(nil)
-
-func NewStorage(cfg StorageConfig) *Storage {
-	// todo use thread safe inmemory https://git.frostfs.info/TrueCloudLab/policy-engine/issues/35
-	local := inmemory.NewInmemoryLocalStorage()
-
-	morph := NewMorphRuleChainStorage(&MorphRuleChainStorageConfig{
-		Contract: cfg.Contract,
-		Cache:    cfg.Cache,
-		Log:      cfg.Log,
-	})
-
-	policyStorage := NewMorphPolicyStorage(&MorphPolicyStorageConfig{
-		Contract: cfg.Contract,
-		Log:      cfg.Log,
-	})
-
-	return &Storage{
-		router: engine.NewDefaultChainRouterWithLocalOverrides(morph, local),
-		morph:  morph,
-		local:  local,
-		policy: policyStorage,
-	}
-}
-
-func (s *Storage) IsAllowed(name chain.Name, target engine.RequestTarget, r resource.Request) (status chain.Status, found bool, err error) {
-	return s.router.IsAllowed(name, target, r)
-}
-
-func (s *Storage) LocalStorage() engine.LocalOverrideStorage {
-	return s.local
-}
-
-func (s *Storage) AddChain(target engine.Target, policyChain *chain.Chain) error {
-	return s.morph.AddChain(target, policyChain)
-}
-
-func (s *Storage) RemoveChain(target engine.Target, chainID chain.ID) error {
-	return s.morph.RemoveChain(target, chainID)
-}
-
-func (s *Storage) ListChains(target engine.Target) ([]*chain.Chain, error) {
-	return s.morph.ListChains(target)
-}
-
-func (s *Storage) PutPolicy(namespace string, cnrID cid.ID, policy []byte) error {
-	return s.policy.PutPolicy(namespace, cnrID, policy)
-}
-
-func (s *Storage) GetPolicy(namespace string, cnrID cid.ID) ([]byte, error) {
-	return s.policy.GetPolicy(namespace, cnrID)
-}
-
-func (s *Storage) DeletePolicy(namespace string, cnrID cid.ID) error {
-	return s.policy.DeletePolicy(namespace, cnrID)
-}

internal/frostfs/services/pool_wrapper.go

@@ -124,65 +124,6 @@ func (w *PoolWrapper) GetSubTree(ctx context.Context, bktInfo *data.BucketInfo,
 	return subtree, nil
 }
 
-type SubTreeStreamImpl struct {
-	r      *treepool.SubTreeReader
-	buffer []*grpcService.GetSubTreeResponse_Body
-	eof    bool
-	index  int
-	ln     int
-}
-
-const bufSize = 1000
-
-func (s *SubTreeStreamImpl) Next() (tree.NodeResponse, error) {
-	if s.index != -1 {
-		node := s.buffer[s.index]
-		s.index++
-		if s.index >= s.ln {
-			s.index = -1
-		}
-		return GetSubTreeResponseBodyWrapper{response: node}, nil
-	}
-	if s.eof {
-		return nil, io.EOF
-	}
-
-	var err error
-	s.ln, err = s.r.Read(s.buffer)
-	if err != nil {
-		if err != io.EOF {
-			return nil, fmt.Errorf("sub tree stream impl pool wrap: %w", handleError(err))
-		}
-		s.eof = true
-	}
-	if s.ln > 0 {
-		s.index = 0
-	}
-
-	return s.Next()
-}
-
-func (w *PoolWrapper) GetSubTreeStream(ctx context.Context, bktInfo *data.BucketInfo, treeID string, rootID uint64, depth uint32) (tree.SubTreeStream, error) {
-	poolPrm := treepool.GetSubTreeParams{
-		CID:         bktInfo.CID,
-		TreeID:      treeID,
-		RootID:      rootID,
-		Depth:       depth,
-		BearerToken: getBearer(ctx, bktInfo),
-	}
-
-	subTreeReader, err := w.p.GetSubTree(ctx, poolPrm)
-	if err != nil {
-		return nil, handleError(err)
-	}
-
-	return &SubTreeStreamImpl{
-		r:      subTreeReader,
-		buffer: make([]*grpcService.GetSubTreeResponse_Body, bufSize),
-		index:  -1,
-	}, nil
-}
-
 func (w *PoolWrapper) AddNode(ctx context.Context, bktInfo *data.BucketInfo, treeID string, parent uint64, meta map[string]string) (uint64, error) {
 	nodeID, err := w.p.AddNode(ctx, treepool.AddNodeParams{
 		CID:         bktInfo.CID,

internal/frostfs/util/util.go

@@ -1,33 +0,0 @@
-package util
-
-import (
-	"fmt"
-	"strings"
-
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/ns"
-	"github.com/nspcc-dev/neo-go/pkg/util"
-)
-
-// ResolveContractHash determine contract hash by resolving NNS name.
-func ResolveContractHash(contractHash, rpcAddress string) (util.Uint160, error) {
-	if hash, err := util.Uint160DecodeStringLE(contractHash); err == nil {
-		return hash, nil
-	}
-
-	splitName := strings.Split(contractHash, ".")
-	if len(splitName) != 2 {
-		return util.Uint160{}, fmt.Errorf("invalid contract name: '%s'", contractHash)
-	}
-
-	var domain container.Domain
-	domain.SetName(splitName[0])
-	domain.SetZone(splitName[1])
-
-	var nns ns.NNS
-	if err := nns.Dial(rpcAddress); err != nil {
-		return util.Uint160{}, fmt.Errorf("dial nns %s: %w", rpcAddress, err)
-	}
-
-	return nns.ResolveContractHash(domain)
-}

internal/logs/logs.go

@@ -12,7 +12,6 @@ const (
 	ServiceCouldntStartOnConfiguredPort                  = "service couldn't start on configured port"                                                         // Warn in ../../cmd/s3-gw/service.go
 	ServiceHasntStartedSinceItsDisabled                  = "service hasn't started since it's disabled"                                                        // Info in ../../cmd/s3-gw/service.go
 	ShuttingDownService                                  = "shutting down service"                                                                             // Info in ../../cmd/s3-gw/service.go
-	CantGracefullyShutDownService                        = "can't gracefully shut down service, force stop"                                                    // Error in ../../cmd/s3-gw/service.go
 	ContainerResolverWillBeDisabled                      = "container resolver will be disabled because of resolvers 'resolver_order' is empty"                // Info in ../../cmd/s3-gw/app.go
 	FailedToInitializeTracing                            = "failed to initialize tracing"                                                                      // Warn in ../../cmd/s3-gw/app.go
 	TracingConfigUpdated                                 = "tracing config updated"                                                                            // Info in ../../cmd/s3-gw/app.go
@@ -22,7 +21,6 @@ const (
 	ApplicationFinished                                  = "application finished"                                                                              // Info in ../../cmd/s3-gw/app.go
 	FetchDomainsPrepareToUseAPI                          = "fetch domains, prepare to use API"                                                                 // Info in ../../cmd/s3-gw/app.go
 	StartingServer                                       = "starting server"                                                                                   // Info in ../../cmd/s3-gw/app.go
-	StartingControlAPI                                   = "starting control API server"                                                                       // Info in ../../cmd/s3-gw/app.go
 	StoppingServer                                       = "stopping server"                                                                                   // Info in ../../cmd/s3-gw/app.go
 	SIGHUPConfigReloadStarted                            = "SIGHUP config reload started"                                                                      // Info in ../../cmd/s3-gw/app.go
 	FailedToReloadConfigBecauseItsMissed                 = "failed to reload config because it's missed"                                                       // Warn in ../../cmd/s3-gw/app.go
@@ -34,8 +32,6 @@ const (
 	FailedToAddServer                                    = "failed to add server"                                                                              // Warn in ../../cmd/s3-gw/app.go
 	AddServer                                            = "add server"                                                                                        // Info in ../../cmd/s3-gw/app.go
 	ResolverNNSWontBeUsedSinceRPCEndpointIsntProvided    = "resolver 'nns' won't be used since 'rpc_endpoint' isn't provided"                                  // Warn in ../../cmd/s3-gw/app.go
-	ControlAPICannotShutdownGracefully                   = "control API cannot shutdown gracefully, forcing stop"                                              // Info in ../../cmd/s3-gw/app.go
-	ControlAPIServiceStopped                             = "control API service stopped"                                                                       // Info in ../../cmd/s3-gw/app.go
 	InvalidLifetimeUsingDefaultValue                     = "invalid lifetime, using default value (in seconds)"                                                // Error in ../../cmd/s3-gw/app_settings.go
 	InvalidCacheSizeUsingDefaultValue                    = "invalid cache size, using default value"                                                           // Error in ../../cmd/s3-gw/app_settings.go
 	FailedToParseDefaultLocationConstraint               = "failed to parse 'default' location constraint, default one will be used"                           // Warn in cmd/s3-gw/app_settings.go
@@ -44,17 +40,11 @@ const (
 	FailedToParseLocationConstraint                      = "failed to parse location constraint, it cannot be used"                                            // Warn in cmd/s3-gw/app_settings.go
 	FailedToParseDefaultCopiesNumbers                    = "failed to parse 'default' copies numbers, default one will be used"                                // Warn in cmd/s3-gw/app_settings.go
 	FailedToParseCopiesNumbers                           = "failed to parse copies numbers, skip"                                                              // Warn in cmd/s3-gw/app_settings.go
-	FailedToParsePublicKey                               = "failed to parse public key, skip"                                                                  // Warn in cmd/s3-gw/app_settings.go
-	DefaultNamespacesCannotBeEmpty                       = "default namespaces cannot be empty, defaults will be used"                                         // Warn in cmd/s3-gw/app_settings.go
-	FailedToParseNamespacesConfig                        = "failed to unmarshal namespaces config"                                                             // Warn in cmd/s3-gw/app_settings.go
-	DefaultNamespaceConfigValuesBeOverwritten            = "default namespace config value be overwritten by values from 'namespaces.config'"                  // Warn in cmd/s3-gw/app_settings.go
-	MultipleDefaultOverridesFound                        = "multiple default overrides found, only one will be used"                                           // Warn in cmd/s3-gw/app_settings.go
 	FailedToParseDefaultDefaultLocationConstraint        = "failed to parse default 'default' location constraint"                                             // Fatal in cmd/s3-gw/app_settings.go
 	ConstraintAdded                                      = "constraint added"                                                                                  // Info in ../../cmd/s3-gw/app_settings.go
 	SkipEmptyAddress                                     = "skip, empty address"                                                                               // Warn in ../../cmd/s3-gw/app_settings.go
 	AddedStoragePeer                                     = "added storage peer"                                                                                // Info in ../../cmd/s3-gw/app_settings.go
 	PrepareConnectionPool                                = "prepare connection pool"                                                                           // Debug in ../../cmd/s3-authmate/modules/utils.go
-	PrepareFrostfsIDClient                               = "prepare frostfsid client"                                                                          // Debug in ../../cmd/s3-authmate/modules/utils.go
 	InvalidCacheEntryType                                = "invalid cache entry type"                                                                          // Warn in ../../api/cache/*
 	InvalidCacheKeyType                                  = "invalid cache key type"                                                                            // Warn in ../../api/cache/objectslist.go
 	ObjectIsCopied                                       = "object is copied"                                                                                  // Info in ../../api/handler/copy.go
@@ -80,6 +70,8 @@ const (
 	CouldntDeletePart                                    = "couldn't delete part"                                                                              // Warn in ../../api/layer/multipart_upload.go
 	PartDetails                                          = "part details"                                                                                      // Debug in ../../api/layer/multipart_upload.go
 	GetObject                                            = "get object"                                                                                        // Debug in ../../api/layer/layer.go
+	ObjectAlreadyRemoved                                 = "object already removed"                                                                            // Debug in ../../api/layer/layer.go
+	ObjectNotFound                                       = "object not found"                                                                                  // Debug in ../../api/layer/layer.go
 	ResolveBucket                                        = "resolve bucket"                                                                                    // Info in ../../api/layer/layer.go
 	CouldntDeleteCorsObject                              = "couldn't delete cors object"                                                                       // Error in ../../api/layer/cors.go
 	PutObject                                            = "put object"                                                                                        // Debug in ../../api/layer/object.go
@@ -93,13 +85,11 @@ const (
 	CouldntCacheAccessControlOperation                   = "couldn't cache access control operation"                                                           // Warn in ../../api/layer/cache.go
 	CouldntPutObjAddressToNameCache                      = "couldn't put obj address to name cache"                                                            // Warn in ../../api/layer/cache.go
 	CouldntCacheListOfObjects                            = "couldn't cache list of objects"                                                                    // Warn in ../../api/layer/cache.go
-	CouldntCacheListSession                              = "couldn't cache list session"                                                                       // Warn in ../../api/layer/cache.go
 	CouldntCacheTags                                     = "couldn't cache tags"                                                                               // Error in ../../api/layer/cache.go
 	CouldntCacheLockInfo                                 = "couldn't cache lock info"                                                                          // Error in ../../api/layer/cache.go
 	CouldntCacheBucketSettings                           = "couldn't cache bucket settings"                                                                    // Warn in ../../api/layer/cache.go
 	CouldntCacheCors                                     = "couldn't cache cors"                                                                               // Warn in ../../api/layer/cache.go
 	CouldntCacheNotificationConfiguration                = "couldn't cache notification configuration"                                                         // Warn in ../../api/layer/cache.go
-	CouldntCacheListPolicyChains                         = "couldn't cache list policy chains"                                                                 // Warn in ../../api/layer/cache.go
 	RequestEnd                                           = "request end"                                                                                       // Info in ../../api/middleware/response.go
 	CouldntReceiveAccessBoxForGateKeyRandomKeyWillBeUsed = "couldn't receive access box for gate key, random key will be used"                                 // Debug in ../../api/middleware/auth.go
 	FailedToPassAuthentication                           = "failed to pass authentication"                                                                     // Error in ../../api/middleware/auth.go
@@ -126,19 +116,4 @@ const (
 	CouldNotInitializeAPIHandler                         = "could not initialize API handler"                                                                  // Fatal in ../../cmd/s3-gw/app.go
 	RuntimeSoftMemoryDefinedWithGOMEMLIMIT               = "soft runtime memory defined with GOMEMLIMIT environment variable, config value skipped"            // Warn in ../../cmd/s3-gw/app.go
 	RuntimeSoftMemoryLimitUpdated                        = "soft runtime memory limit value updated"                                                           // Info in ../../cmd/s3-gw/app.go
-	AnonRequestSkipFrostfsIDValidation                   = "anon request, skip FrostfsID validation"                                                           // Debug in ../../api/middleware/auth.go
-	FrostfsIDValidationFailed                            = "FrostfsID validation failed"                                                                       // Error in ../../api/middleware/auth.go
-	InitFrostfsIDContractFailed                          = "init frostfsid contract failed"                                                                    // Fatal in ../../cmd/s3-gw/app.go
-	InitPolicyContractFailed                             = "init policy contract failed"                                                                       // Fatal in ../../cmd/s3-gw/app.go
-	ControlAPIHealthcheck                                = "healthcheck request"
-	ControlAPIPutPolicies                                = "put policies request"
-	ControlAPIRemovePolicies                             = "remove policies request"
-	ControlAPIGetPolicy                                  = "get policy request"
-	ControlAPIListPolicies                               = "list policies request"
-	PolicyValidationFailed                               = "policy validation failed"
-	ParseTreeNode                                        = "parse tree node"
-	FailedToGetRealObjectSize                            = "failed to get real object size"
-	CouldntDeleteObjectFromStorageContinueDeleting       = "couldn't delete object from storage, continue deleting from tree"
-	CouldntPutAccessBoxIntoCache                         = "couldn't put accessbox into cache"
-	InvalidAccessBoxCacheRemovingCheckInterval           = "invalid accessbox check removing interval, using default value"
 )

metrics/app.go

@@ -65,12 +65,12 @@ func (m *AppMetrics) Handler() http.Handler {
 	return m.gate.Handler()
 }
 
-func (m *AppMetrics) Update(user, bucket, cnrID, ns string, reqType RequestType, in, out uint64) {
+func (m *AppMetrics) Update(user, bucket, cnrID string, reqType RequestType, in, out uint64) {
 	if !m.isEnabled() {
 		return
 	}
 
-	m.gate.Billing.apiStat.Update(user, bucket, cnrID, ns, reqType, in, out)
+	m.gate.Billing.apiStat.Update(user, bucket, cnrID, reqType, in, out)
 }
 
 func (m *AppMetrics) Statistic() *APIStatMetrics {

metrics/billing.go

@@ -69,9 +69,8 @@ type (
 	}
 
 	bucketKey struct {
-		name      string
-		cid       string
-		namespace string
+		name string
+		cid  string
 	}
 
 	bucketStat struct {
@@ -89,7 +88,6 @@ type (
 		User        string
 		Bucket      string
 		ContainerID string
-		Namespace   string
 	}
 
 	UserMetricsInfo struct {
@@ -110,7 +108,7 @@ type (
 	}
 )
 
-func (u *UsersAPIStats) Update(user, bucket, cnrID, ns string, reqType RequestType, in, out uint64) {
+func (u *UsersAPIStats) Update(user, bucket, cnrID string, reqType RequestType, in, out uint64) {
 	u.Lock()
 	defer u.Unlock()
 
@@ -127,9 +125,8 @@ func (u *UsersAPIStats) Update(user, bucket, cnrID, ns string, reqType RequestTy
 	}
 
 	key := bucketKey{
-		name:      bucket,
-		cid:       cnrID,
-		namespace: ns,
+		name: bucket,
+		cid:  cnrID,
 	}
 
 	bktStat := usersStat.buckets[key]
@@ -154,7 +151,6 @@ func (u *UsersAPIStats) DumpMetrics() UserMetrics {
 				User:        user,
 				Bucket:      key.name,
 				ContainerID: key.cid,
-				Namespace:   key.namespace,
 			}
 
 			if bktStat.InTraffic != 0 {
@@ -236,7 +232,6 @@ func (b *billingMetrics) Collect(ch chan<- prometheus.Metric) {
 			value.Bucket,
 			value.ContainerID,
 			value.Operation.String(),
-			value.Namespace,
 		)
 	}
 
@@ -249,7 +244,6 @@ func (b *billingMetrics) Collect(ch chan<- prometheus.Metric) {
 			value.Bucket,
 			value.ContainerID,
 			value.Type.String(),
-			value.Namespace,
 		)
 	}
 }

metrics/desc.go

@@ -64,7 +64,7 @@ var appMetricsDesc = map[string]map[string]Description{
 			Subsystem:      billingSubsystem,
 			Name:           userRequestsMetric,
 			Help:           "Accumulated user requests",
-			VariableLabels: []string{"user", "bucket", "cid", "operation", "namespace"},
+			VariableLabels: []string{"user", "bucket", "cid", "operation"},
 		},
 		userTrafficMetric: Description{
 			Type:           dto.MetricType_GAUGE,
@@ -72,7 +72,7 @@ var appMetricsDesc = map[string]map[string]Description{
 			Subsystem:      billingSubsystem,
 			Name:           userTrafficMetric,
 			Help:           "Accumulated user traffic",
-			VariableLabels: []string{"user", "bucket", "cid", "direction", "namespace"},
+			VariableLabels: []string{"user", "bucket", "cid", "direction"},
 		},
 	},
 	stateSubsystem: {

pkg/service/control/client/client.go

@@ -1,162 +0,0 @@
-package client
-
-import (
-	"context"
-	"fmt"
-
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/pkg/service/control"
-	controlSvc "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/pkg/service/control/server"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
-	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
-	"go.uber.org/zap"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-)
-
-type Client struct {
-	svc control.ControlServiceClient
-	key *keys.PrivateKey
-}
-
-type Config struct {
-	Logger *zap.Logger
-}
-
-type PolicyData struct {
-	Namespace string
-	Chain     *chain.Chain
-}
-
-type PolicyInfo struct {
-	Namespace string
-	ChainID   chain.ID
-}
-
-func New(ctx context.Context, addr string, key *keys.PrivateKey) (*Client, error) {
-	conn, err := grpc.Dial(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
-	if err != nil {
-		return nil, fmt.Errorf("failed to dial s3 gw control api: %w", err)
-	}
-
-	svc := control.NewControlServiceClient(conn)
-
-	cli := &Client{
-		svc: svc,
-		key: key,
-	}
-
-	return cli, cli.Healthcheck(ctx)
-}
-
-func (c *Client) Healthcheck(ctx context.Context) error {
-	req := &control.HealthCheckRequest{}
-	if err := controlSvc.SignMessage(&c.key.PrivateKey, req); err != nil {
-		return err
-	}
-
-	res, err := c.svc.HealthCheck(ctx, req)
-	if err != nil {
-		return err
-	}
-
-	if res.Body.HealthStatus != control.HealthStatus_READY {
-		return fmt.Errorf("service isn't ready, status: %s", res.Body.HealthStatus)
-	}
-
-	return nil
-}
-
-func (c *Client) PutPolicies(ctx context.Context, policies []PolicyData) error {
-	chainDatas := make([]*control.PutPoliciesRequest_ChainData, len(policies))
-	for i := range policies {
-		chainDatas[i] = &control.PutPoliciesRequest_ChainData{
-			Namespace: policies[i].Namespace,
-			Chain:     policies[i].Chain.Bytes(),
-		}
-	}
-
-	req := &control.PutPoliciesRequest{
-		Body: &control.PutPoliciesRequest_Body{
-			ChainDatas: chainDatas,
-		},
-	}
-
-	if err := controlSvc.SignMessage(&c.key.PrivateKey, req); err != nil {
-		return err
-	}
-
-	_, err := c.svc.PutPolicies(ctx, req)
-	return err
-}
-
-func (c *Client) RemovePolicies(ctx context.Context, policies []PolicyInfo) error {
-	chainInfos := make([]*control.RemovePoliciesRequest_ChainInfo, len(policies))
-	for i := range policies {
-		chainInfos[i] = &control.RemovePoliciesRequest_ChainInfo{
-			Namespace: policies[i].Namespace,
-			ChainID:   []byte(policies[i].ChainID),
-		}
-	}
-
-	req := &control.RemovePoliciesRequest{
-		Body: &control.RemovePoliciesRequest_Body{
-			ChainInfos: chainInfos,
-		},
-	}
-
-	if err := controlSvc.SignMessage(&c.key.PrivateKey, req); err != nil {
-		return err
-	}
-
-	_, err := c.svc.RemovePolicies(ctx, req)
-	return err
-}
-
-func (c *Client) GetPolicy(ctx context.Context, namespace string, chainID chain.ID) (*chain.Chain, error) {
-	req := &control.GetPolicyRequest{
-		Body: &control.GetPolicyRequest_Body{
-			Namespace: namespace,
-			ChainID:   []byte(chainID),
-		},
-	}
-
-	if err := controlSvc.SignMessage(&c.key.PrivateKey, req); err != nil {
-		return nil, err
-	}
-
-	resp, err := c.svc.GetPolicy(ctx, req)
-	if err != nil {
-		return nil, err
-	}
-
-	var policyChain chain.Chain
-	if err = policyChain.DecodeBytes(resp.GetBody().GetChain()); err != nil {
-		return nil, err
-	}
-
-	return &policyChain, nil
-}
-
-func (c *Client) ListPolicies(ctx context.Context, namespace string) ([]chain.ID, error) {
-	req := &control.ListPoliciesRequest{
-		Body: &control.ListPoliciesRequest_Body{
-			Namespace: namespace,
-		},
-	}
-
-	if err := controlSvc.SignMessage(&c.key.PrivateKey, req); err != nil {
-		return nil, err
-	}
-
-	resp, err := c.svc.ListPolicies(ctx, req)
-	if err != nil {
-		return nil, err
-	}
-
-	res := make([]chain.ID, len(resp.GetBody().GetChainIDs()))
-	for i, chainID := range resp.GetBody().GetChainIDs() {
-		res[i] = chain.ID(chainID)
-	}
-
-	return res, nil
-}

pkg/service/control/server/server.go

@@ -1,316 +0,0 @@
-package server
-
-import (
-	"bytes"
-	"context"
-	"crypto/ecdsa"
-	"encoding/hex"
-	"errors"
-	"fmt"
-
-	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/refs"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
-	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/pkg/service/control"
-	frostfscrypto "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/crypto"
-	frostfsecdsa "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/crypto/ecdsa"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine/inmemory"
-	"go.uber.org/zap"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-)
-
-type Server struct {
-	*cfg
-}
-
-type Settings interface {
-	ResolveNamespaceAlias(ns string) string
-	FetchRawKeys() [][]byte
-}
-
-type defaultSettings struct{}
-
-func (f defaultSettings) FetchRawKeys() [][]byte                 { return nil }
-func (f defaultSettings) ResolveNamespaceAlias(ns string) string { return ns }
-
-// Option of the Server's constructor.
-type Option func(*cfg)
-
-type cfg struct {
-	log *zap.Logger
-
-	settings Settings
-
-	chainStorage engine.LocalOverrideStorage
-}
-
-func defaultCfg() *cfg {
-	return &cfg{
-		log:          zap.NewNop(),
-		settings:     defaultSettings{},
-		chainStorage: inmemory.NewInmemoryLocalStorage(),
-	}
-}
-
-// New creates, initializes and returns new Server instance.
-func New(opts ...Option) *Server {
-	c := defaultCfg()
-
-	for _, opt := range opts {
-		opt(c)
-	}
-
-	c.log = c.log.With(zap.String("service", "control API"))
-
-	return &Server{
-		cfg: c,
-	}
-}
-
-// WithSettings returns option to add settings to use Control service.
-func WithSettings(settings Settings) Option {
-	return func(c *cfg) {
-		c.settings = settings
-	}
-}
-
-// WithLogger returns option to set logger.
-func WithLogger(log *zap.Logger) Option {
-	return func(c *cfg) {
-		c.log = log
-	}
-}
-
-// WithChainStorage returns option to set logger.
-func WithChainStorage(chainStorage engine.LocalOverrideStorage) Option {
-	return func(c *cfg) {
-		c.chainStorage = chainStorage
-	}
-}
-
-// HealthCheck returns health status of the local node.
-//
-// If request is unsigned or signed by disallowed key, permission error returns.
-func (s *Server) HealthCheck(_ context.Context, req *control.HealthCheckRequest) (*control.HealthCheckResponse, error) {
-	s.log.Info(logs.ControlAPIHealthcheck, zap.String("key", hex.EncodeToString(req.Signature.Key)))
-
-	// verify request
-	if err := s.isValidRequest(req); err != nil {
-		return nil, status.Error(codes.PermissionDenied, err.Error())
-	}
-
-	resp := &control.HealthCheckResponse{
-		Body: &control.HealthCheckResponse_Body{
-			HealthStatus: control.HealthStatus_READY,
-		},
-	}
-
-	return resp, nil
-}
-
-// PutPolicies replaces existing policies.
-//
-// If request is unsigned or signed by disallowed key, permission error returns.
-func (s *Server) PutPolicies(_ context.Context, req *control.PutPoliciesRequest) (*control.PutPoliciesResponse, error) {
-	s.log.Info(logs.ControlAPIPutPolicies, zap.String("key", hex.EncodeToString(req.Signature.Key)))
-
-	// verify request
-	if err := s.isValidRequest(req); err != nil {
-		return nil, status.Error(codes.PermissionDenied, err.Error())
-	}
-
-	for _, data := range req.GetBody().GetChainDatas() {
-		if err := s.putPolicy(data); err != nil {
-			return nil, err
-		}
-	}
-
-	return &control.PutPoliciesResponse{}, nil
-}
-
-func (s *Server) putPolicy(data *control.PutPoliciesRequest_ChainData) error {
-	var overrideChain chain.Chain
-	if err := overrideChain.DecodeBytes(data.GetChain()); err != nil {
-		return status.Error(codes.InvalidArgument, fmt.Sprintf("failed to parse body: %s", err.Error()))
-	}
-
-	if len(overrideChain.ID) == 0 {
-		return status.Error(codes.InvalidArgument, "missing chain id")
-	}
-
-	ns := s.settings.ResolveNamespaceAlias(data.GetNamespace())
-	if _, err := s.chainStorage.AddOverride(chain.S3, engine.NamespaceTarget(ns), &overrideChain); err != nil {
-		return status.Error(codes.Internal, err.Error())
-	}
-
-	return nil
-}
-
-// RemovePolicies removes existing policies.
-//
-// If request is unsigned or signed by disallowed key, permission error returns.
-func (s *Server) RemovePolicies(_ context.Context, req *control.RemovePoliciesRequest) (*control.RemovePoliciesResponse, error) {
-	s.log.Info(logs.ControlAPIRemovePolicies, zap.String("key", hex.EncodeToString(req.Signature.Key)))
-
-	// verify request
-	if err := s.isValidRequest(req); err != nil {
-		return nil, status.Error(codes.PermissionDenied, err.Error())
-	}
-
-	for _, info := range req.GetBody().GetChainInfos() {
-		if err := s.removePolicy(info); err != nil {
-			return nil, err
-		}
-	}
-
-	return &control.RemovePoliciesResponse{}, nil
-}
-
-func (s *Server) removePolicy(info *control.RemovePoliciesRequest_ChainInfo) error {
-	ns := s.settings.ResolveNamespaceAlias(info.GetNamespace())
-	err := s.chainStorage.RemoveOverride(chain.S3, engine.NamespaceTarget(ns), chain.ID(info.GetChainID()))
-	if err != nil {
-		if isNotFoundError(err) {
-			return status.Error(codes.NotFound, err.Error())
-		}
-		return status.Error(codes.InvalidArgument, err.Error())
-	}
-	return nil
-}
-
-// GetPolicy returns existing policy.
-//
-// If request is unsigned or signed by disallowed key, permission error returns.
-func (s *Server) GetPolicy(_ context.Context, req *control.GetPolicyRequest) (*control.GetPolicyResponse, error) {
-	s.log.Info(logs.ControlAPIGetPolicy, zap.String("namespace", req.GetBody().GetNamespace()),
-		zap.Binary("chainId", req.GetBody().GetChainID()), zap.String("key", hex.EncodeToString(req.Signature.Key)))
-
-	// verify request
-	if err := s.isValidRequest(req); err != nil {
-		return nil, status.Error(codes.PermissionDenied, err.Error())
-	}
-
-	ns := s.settings.ResolveNamespaceAlias(req.GetBody().GetNamespace())
-	overrideChain, err := s.chainStorage.GetOverride(chain.S3, engine.NamespaceTarget(ns), chain.ID(req.GetBody().GetChainID()))
-	if err != nil {
-		return nil, status.Error(codes.InvalidArgument, err.Error())
-	}
-
-	return &control.GetPolicyResponse{Body: &control.GetPolicyResponse_Body{Chain: overrideChain.Bytes()}}, nil
-}
-
-// ListPolicies lists existing policies.
-//
-// If request is unsigned or signed by disallowed key, permission error returns.
-func (s *Server) ListPolicies(_ context.Context, req *control.ListPoliciesRequest) (*control.ListPoliciesResponse, error) {
-	s.log.Info(logs.ControlAPIListPolicies, zap.String("namespace", req.GetBody().GetNamespace()),
-		zap.String("key", hex.EncodeToString(req.Signature.Key)))
-
-	// verify request
-	if err := s.isValidRequest(req); err != nil {
-		return nil, status.Error(codes.PermissionDenied, err.Error())
-	}
-
-	ns := s.settings.ResolveNamespaceAlias(req.GetBody().GetNamespace())
-	chains, err := s.chainStorage.ListOverrides(chain.S3, engine.NamespaceTarget(ns))
-	if err != nil {
-		return nil, status.Error(codes.InvalidArgument, err.Error())
-	}
-
-	res := make([][]byte, len(chains))
-	for i := range chains {
-		res[i] = []byte(chains[i].ID)
-	}
-
-	return &control.ListPoliciesResponse{Body: &control.ListPoliciesResponse_Body{ChainIDs: res}}, nil
-}
-
-// SignedMessage is an interface of Control service message.
-type SignedMessage interface {
-	ReadSignedData([]byte) ([]byte, error)
-	GetSignature() *control.Signature
-	SetSignature(*control.Signature)
-}
-
-var errDisallowedKey = errors.New("key is not in the allowed list")
-var errMissingSignature = errors.New("missing signature")
-var errInvalidSignature = errors.New("invalid signature")
-
-func (s *Server) isValidRequest(req SignedMessage) error {
-	sign := req.GetSignature()
-	if sign == nil {
-		return errMissingSignature
-	}
-
-	var (
-		key     = sign.GetKey()
-		allowed = false
-	)
-
-	// check if key is allowed
-	for _, authKey := range s.settings.FetchRawKeys() {
-		if allowed = bytes.Equal(authKey, key); allowed {
-			break
-		}
-	}
-
-	if !allowed {
-		return errDisallowedKey
-	}
-
-	// verify signature
-	binBody, err := req.ReadSignedData(nil)
-	if err != nil {
-		return fmt.Errorf("marshal request body: %w", err)
-	}
-
-	var sigV2 refs.Signature
-	sigV2.SetKey(sign.GetKey())
-	sigV2.SetSign(sign.GetSign())
-	sigV2.SetScheme(refs.ECDSA_SHA512)
-
-	var sig frostfscrypto.Signature
-	if err := sig.ReadFromV2(sigV2); err != nil {
-		return fmt.Errorf("can't read signature: %w", err)
-	}
-
-	if !sig.Verify(binBody) {
-		return errInvalidSignature
-	}
-
-	return nil
-}
-
-// SignMessage signs Control service message with private key.
-func SignMessage(key *ecdsa.PrivateKey, msg SignedMessage) error {
-	binBody, err := msg.ReadSignedData(nil)
-	if err != nil {
-		return fmt.Errorf("marshal request body: %w", err)
-	}
-
-	var sig frostfscrypto.Signature
-
-	err = sig.Calculate(frostfsecdsa.Signer(*key), binBody)
-	if err != nil {
-		return fmt.Errorf("calculate signature: %w", err)
-	}
-
-	var sigV2 refs.Signature
-	sig.WriteToV2(&sigV2)
-
-	var sigControl control.Signature
-	sigControl.Key = sigV2.GetKey()
-	sigControl.Sign = sigV2.GetSign()
-
-	msg.SetSignature(&sigControl)
-
-	return nil
-}
-
-func isNotFoundError(err error) bool {
-	return errors.Is(err, engine.ErrChainNameNotFound) ||
-		errors.Is(err, engine.ErrChainNotFound) ||
-		errors.Is(err, engine.ErrResourceNotFound)
-}

pkg/service/control/service.proto

@@ -1,180 +0,0 @@
-syntax = "proto3";
-
-package s3gw.control;
-
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/pkg/service/control";
-
-// `ControlService` provides an interface for internal work with the storage node.
-service ControlService {
-  // Performs health check of the storage node.
-  rpc HealthCheck (HealthCheckRequest) returns (HealthCheckResponse);
-
-  rpc PutPolicies (PutPoliciesRequest) returns (PutPoliciesResponse);
-
-  rpc RemovePolicies (RemovePoliciesRequest) returns (RemovePoliciesResponse);
-
-  rpc GetPolicy (GetPolicyRequest) returns (GetPolicyResponse);
-
-  rpc ListPolicies (ListPoliciesRequest) returns (ListPoliciesResponse);
-}
-
-// Signature of some message.
-message Signature {
-  // Public key used for signing.
-  bytes key = 1 [json_name = "key"];
-
-  // Binary signature.
-  bytes sign = 2 [json_name = "signature"];
-}
-
-// Health check request.
-message HealthCheckRequest {
-  message Body {
-  }
-
-  // Body of health check request message.
-  Body body = 1;
-
-  // Body signature.
-  Signature signature = 2;
-}
-
-// Health check response.
-message HealthCheckResponse {
-  // Health check response body
-  message Body {
-    // Health status of storage node application.
-    HealthStatus health_status = 1;
-  }
-
-  // Body of health check response message.
-  Body body = 1;
-
-  Signature signature = 2;
-}
-
-
-// Health status of the storage node application.
-enum HealthStatus {
-  // Undefined status, default value.
-  HEALTH_STATUS_UNDEFINED = 0;
-
-  // Storage node application is starting.
-  STARTING = 1;
-
-  // Storage node application is started and serves all services.
-  READY = 2;
-
-  // Storage node application is shutting down.
-  SHUTTING_DOWN = 3;
-}
-
-// Put policies request.
-message PutPoliciesRequest {
-  message ChainData {
-    // Namespace.
-    string namespace = 1;
-    // Chain rules.
-    bytes chain = 2;
-  }
-
-  message Body {
-    repeated ChainData chainDatas = 1;
-  }
-
-  Body body = 1;
-
-  // Body signature.
-  Signature signature = 2;
-}
-
-// Put policies response.
-message PutPoliciesResponse {
-  message Body {
-  }
-
-  Body body = 1;
-
-  Signature signature = 2;
-}
-
-// Remove policies request.
-message RemovePoliciesRequest {
-  message ChainInfo {
-    // Namespace.
-    string namespace = 1;
-    // Chain id to remove.
-    bytes chainID = 2;
-  }
-
-  message Body {
-    repeated ChainInfo chainInfos = 1;
-  }
-
-  Body body = 1;
-
-  // Body signature.
-  Signature signature = 2;
-}
-
-// Remove policies response.
-message RemovePoliciesResponse {
-  message Body {
-  }
-
-  Body body = 1;
-
-  Signature signature = 2;
-}
-
-// Get policy request.
-message GetPolicyRequest {
-  message Body {
-    // Namespace.
-    string namespace = 1;
-    // Chain id to remove.
-    bytes chainID = 2;
-  }
-
-  Body body = 1;
-
-  // Body signature.
-  Signature signature = 2;
-}
-
-// Get policy response.
-message GetPolicyResponse {
-  message Body {
-    // Chain rules.
-    bytes chain = 1;
-  }
-
-  Body body = 1;
-
-  Signature signature = 2;
-}
-
-// List policies request.
-message ListPoliciesRequest {
-  message Body {
-    // Namespace.
-    string namespace = 1;
-  }
-
-  Body body = 1;
-
-  // Body signature.
-  Signature signature = 2;
-}
-
-// List policies response.
-message ListPoliciesResponse {
-  message Body {
-    // Chain ids.
-    repeated bytes chainIDs = 1;
-  }
-
-  Body body = 1;
-
-  Signature signature = 2;
-}