potyarkin/frostfs-node
1
0
Fork 0
forked from TrueCloudLab/frostfs-node
Code Pull requests Activity

[#190] Add isOwnerFromKey helper function in ACL

Browse source 
This function takes public key and returns true if
owner id was produced by this key.

Signed-off-by: Alex Vanin <alexey@nspcc.ru>
This commit is contained in:
Alex Vanin 2020-11-19 17:17:15 +03:00 • committed by Alex Vanin
parent a14bb6292b
commit f0537b35c1
2 changed files with 25 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

9
pkg/services/object/acl/classifier.go
View file

@ -201,15 +201,12 @@ func ownerFromToken(token *session.SessionToken) (*owner.ID, *ecdsa.PublicKey, e
// 2. Then check if session token owner issued the session token
tokenIssuerKey := crypto.UnmarshalPublicKey(token.GetSignature().GetKey())
tokenIssuerWallet, err := owner.NEO3WalletFromPublicKey(tokenIssuerKey)
if err != nil {
return nil, nil, errors.Wrap(ErrMalformedRequest, "invalid token issuer key")
}
tokenOwner := owner.NewIDFromV2(token.GetBody().GetOwnerID())
if !bytes.Equal(token.GetBody().GetOwnerID().GetValue(), tokenIssuerWallet.Bytes()) {
if !isOwnerFromKey(tokenOwner, tokenIssuerKey) {
// todo: in this case we can issue all owner keys from neofs.id and check once again
return nil, nil, errors.Wrap(ErrMalformedRequest, "invalid session token owner")
}
return owner.NewIDFromV2(token.GetBody().GetOwnerID()), tokenIssuerKey, nil
return tokenOwner, tokenIssuerKey, nil
}