import logging import allure import pytest from frostfs_testlib.resources.wellknown_acl import PUBLIC_ACL from frostfs_testlib.steps.acl import ( bearer_token_base64_from_file, create_eacl, form_bearertoken_file, set_eacl, sign_bearer, wait_for_cache_expired, ) from frostfs_testlib.steps.cli.container import create_container from frostfs_testlib.steps.http.http_gate import upload_via_http_gate_curl, verify_object_hash from frostfs_testlib.storage.dataclasses.acl import EACLAccess, EACLOperation, EACLRole, EACLRule from frostfs_testlib.storage.dataclasses.object_size import ObjectSize from frostfs_testlib.testing.cluster_test_base import ClusterTestBase from frostfs_testlib.utils.file_utils import generate_file logger = logging.getLogger("NeoLogger") @pytest.mark.sanity @pytest.mark.http_gate @pytest.mark.skip("Skipped due to deprecated PUT via http") @pytest.mark.http_put class Test_http_bearer(ClusterTestBase): PLACEMENT_RULE = "REP 2 IN X CBF 1 SELECT 2 FROM * AS X" @pytest.fixture(scope="class", autouse=True) @allure.title("[Class/Autouse]: Prepare wallet and deposit") def prepare_wallet(self, default_wallet): Test_http_bearer.wallet = default_wallet @pytest.fixture(scope="class") def user_container(self) -> str: return create_container( wallet=self.wallet, shell=self.shell, endpoint=self.cluster.default_rpc_endpoint, rule=self.PLACEMENT_RULE, basic_acl=PUBLIC_ACL, ) @pytest.fixture(scope="class") def eacl_deny_for_others(self, user_container: str) -> None: with allure.step(f"Set deny all operations for {EACLRole.OTHERS} via eACL"): eacl = EACLRule( access=EACLAccess.DENY, role=EACLRole.OTHERS, operation=EACLOperation.PUT ) set_eacl( self.wallet, user_container, create_eacl(user_container, eacl, shell=self.shell), shell=self.shell, endpoint=self.cluster.default_rpc_endpoint, ) wait_for_cache_expired() @pytest.fixture(scope="class") def bearer_token_no_limit_for_others(self, user_container: str) -> str: with allure.step(f"Create bearer token for {EACLRole.OTHERS} with all operations allowed"): bearer = form_bearertoken_file( self.wallet, user_container, [ EACLRule(operation=op, access=EACLAccess.ALLOW, role=EACLRole.OTHERS) for op in EACLOperation ], shell=self.shell, endpoint=self.cluster.default_rpc_endpoint, sign=False, ) bearer_signed = f"{bearer}_signed" sign_bearer( shell=self.shell, wallet_path=self.wallet, eacl_rules_file_from=bearer, eacl_rules_file_to=bearer_signed, json=False, ) return bearer_token_base64_from_file(bearer_signed) @allure.title(f"[NEGATIVE] Put object without bearer token for {EACLRole.OTHERS}") def test_unable_put_without_bearer_token( self, simple_object_size: ObjectSize, user_container: str, eacl_deny_for_others ): eacl_deny_for_others upload_via_http_gate_curl( cid=user_container, filepath=generate_file(simple_object_size.value), endpoint=self.cluster.default_http_gate_endpoint, error_pattern="access to object operation denied", ) @pytest.mark.skip("Temp disable for v0.37") def test_put_with_bearer_when_eacl_restrict( self, object_size: ObjectSize, user_container: str, eacl_deny_for_others, bearer_token_no_limit_for_others: str, ): eacl_deny_for_others bearer = bearer_token_no_limit_for_others file_path = generate_file(object_size.value) with allure.step( f"Put object with bearer token for {EACLRole.OTHERS}, then get and verify hashes" ): headers = [f" -H 'Authorization: Bearer {bearer}'"] oid = upload_via_http_gate_curl( cid=user_container, filepath=file_path, endpoint=self.cluster.default_http_gate_endpoint, headers=headers, ) verify_object_hash( oid=oid, file_name=file_path, wallet=self.wallet, cid=user_container, shell=self.shell, nodes=self.cluster.storage_nodes, endpoint=self.cluster.default_http_gate_endpoint, )