[#32] Add request sender classifier

ACL has to classify request senders by roles:
- owner of the container,
- request from container or inner ring node,
- any other request.

According to this roles ACL checker use different
bits of basic ACL to grant or deny access.

Signed-off-by: Alex Vanin <alexey@nspcc.ru>

pkg/services/object/acl/basic.go

@@ -0,0 +1,157 @@
+package acl
+
+import (
+	"context"
+
+	"github.com/nspcc-dev/neofs-api-go/v2/acl"
+	"github.com/nspcc-dev/neofs-api-go/v2/container"
+	"github.com/nspcc-dev/neofs-api-go/v2/object"
+	"github.com/nspcc-dev/neofs-api-go/v2/refs"
+	"github.com/pkg/errors"
+)
+
+type (
+	// ContainerGetter accesses NeoFS container storage.
+	ContainerGetter interface {
+		Get(*refs.ContainerID) (*container.Container, error)
+	}
+
+	Classifier interface {
+		Classify(RequestV2, *refs.ContainerID) acl.Role
+	}
+
+	// BasicChecker checks basic ACL rules.
+	BasicChecker struct {
+		sender SenderClassifier
+		next   object.Service
+	}
+
+	putStreamBasicChecker struct {
+		sender SenderClassifier
+		next   object.PutObjectStreamer
+	}
+
+	getStreamBasicChecker struct {
+		sender SenderClassifier
+		next   object.GetObjectStreamer
+	}
+
+	searchStreamBasicChecker struct {
+		sender SenderClassifier
+		next   object.SearchObjectStreamer
+	}
+
+	getRangeStreamBasicChecker struct {
+		sender SenderClassifier
+		next   object.GetRangeObjectStreamer
+	}
+)
+
+var (
+	ErrMalformedRequest = errors.New("malformed request")
+	ErrUnknownRole      = errors.New("can't classify request sender")
+)
+
+// NewBasicChecker is a constructor for basic ACL checker of object requests.
+func NewBasicChecker(c SenderClassifier, next object.Service) BasicChecker {
+	return BasicChecker{
+		sender: c,
+		next:   next,
+	}
+}
+
+func (b BasicChecker) Get(
+	ctx context.Context,
+	request *object.GetRequest) (object.GetObjectStreamer, error) {
+
+	// get container address and do not panic at malformed request
+	var addr *refs.Address
+	if body := request.GetBody(); body == nil {
+		return nil, ErrMalformedRequest
+	} else {
+		addr = body.GetAddress()
+	}
+
+	role := b.sender.Classify(request, addr.GetContainerID())
+	if role == acl.RoleUnknown {
+		return nil, ErrUnknownRole
+	}
+
+	stream, err := b.next.Get(ctx, request)
+	return getStreamBasicChecker{
+		sender: b.sender,
+		next:   stream,
+	}, err
+}
+
+func (b BasicChecker) Put(ctx context.Context) (object.PutObjectStreamer, error) {
+	streamer, err := b.next.Put(ctx)
+
+	return putStreamBasicChecker{
+		sender: b.sender,
+		next:   streamer,
+	}, err
+}
+
+func (b BasicChecker) Head(
+	ctx context.Context,
+	request *object.HeadRequest) (*object.HeadResponse, error) {
+
+	return b.next.Head(ctx, request)
+}
+
+func (b BasicChecker) Search(
+	ctx context.Context,
+	request *object.SearchRequest) (object.SearchObjectStreamer, error) {
+
+	stream, err := b.next.Search(ctx, request)
+	return searchStreamBasicChecker{
+		sender: b.sender,
+		next:   stream,
+	}, err
+}
+
+func (b BasicChecker) Delete(
+	ctx context.Context,
+	request *object.DeleteRequest) (*object.DeleteResponse, error) {
+
+	return b.next.Delete(ctx, request)
+}
+
+func (b BasicChecker) GetRange(
+	ctx context.Context,
+	request *object.GetRangeRequest) (object.GetRangeObjectStreamer, error) {
+
+	stream, err := b.next.GetRange(ctx, request)
+	return getRangeStreamBasicChecker{
+		sender: b.sender,
+		next:   stream,
+	}, err
+}
+
+func (b BasicChecker) GetRangeHash(
+	ctx context.Context,
+	request *object.GetRangeHashRequest) (*object.GetRangeHashResponse, error) {
+
+	return b.next.GetRangeHash(ctx, request)
+}
+
+func (p putStreamBasicChecker) Send(request *object.PutRequest) error {
+	return p.next.Send(request)
+}
+
+func (p putStreamBasicChecker) CloseAndRecv() (*object.PutResponse, error) {
+	return p.next.CloseAndRecv()
+}
+
+func (g getStreamBasicChecker) Recv() (*object.GetResponse, error) {
+	return g.next.Recv()
+}
+
+func (s searchStreamBasicChecker) Recv() (*object.SearchResponse, error) {
+	return s.next.Recv()
+}
+
+func (g getRangeStreamBasicChecker) Recv() (*object.GetRangeResponse, error) {
+	return g.next.Recv()
+}