From 21f0fea5a72dfe1597dcd3a9d1e8c80d98295d40 Mon Sep 17 00:00:00 2001 From: jonaustin09 Date: Wed, 14 Jun 2023 22:39:27 +0400 Subject: [PATCH 1/3] feat: Implemented GetBucketACL, PutBucketACL posix functions, fixed authentication middleware signed headers bug --- backend/auth/acl.go | 28 +++++ backend/backend.go | 4 +- backend/backend_moq_test.go | 76 ++----------- backend/backend_test.go | 21 ++-- backend/posix/posix.go | 149 +++++++++++++++++++++++++- s3api/controllers/backend_moq_test.go | 76 ++----------- s3api/controllers/base.go | 23 ++-- s3api/controllers/base_test.go | 7 +- s3api/middlewares/authentication.go | 3 +- 9 files changed, 227 insertions(+), 160 deletions(-) create mode 100644 backend/auth/acl.go diff --git a/backend/auth/acl.go b/backend/auth/acl.go new file mode 100644 index 00000000..21f344bd --- /dev/null +++ b/backend/auth/acl.go @@ -0,0 +1,28 @@ +// Copyright 2023 Versity Software +// This file is licensed under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package auth + +import "github.com/aws/aws-sdk-go-v2/service/s3/types" + +type ACL struct { + ACL types.BucketCannedACL + Owner string + Grantees []Grantee +} + +type Grantee struct { + Permission types.Permission + Access string +} diff --git a/backend/backend.go b/backend/backend.go index 463af2c1..a778d5d8 100644 --- a/backend/backend.go +++ b/backend/backend.go @@ -33,7 +33,7 @@ type Backend interface { ListBuckets() (*s3.ListBucketsOutput, error) HeadBucket(bucket string) (*s3.HeadBucketOutput, error) GetBucketAcl(bucket string) (*s3.GetBucketAclOutput, error) - PutBucket(bucket string) error + PutBucket(bucket, owner string) error PutBucketAcl(*s3.PutBucketAclInput) error DeleteBucket(bucket string) error @@ -96,7 +96,7 @@ func (BackendUnsupported) GetBucketAcl(bucket string) (*s3.GetBucketAclOutput, e func (BackendUnsupported) HeadBucket(bucket string) (*s3.HeadBucketOutput, error) { return nil, s3err.GetAPIError(s3err.ErrNotImplemented) } -func (BackendUnsupported) PutBucket(bucket string) error { +func (BackendUnsupported) PutBucket(bucket, owner string) error { return s3err.GetAPIError(s3err.ErrNotImplemented) } func (BackendUnsupported) DeleteBucket(bucket string) error { diff --git a/backend/backend_moq_test.go b/backend/backend_moq_test.go index 6ecfc5b2..398133b1 100644 --- a/backend/backend_moq_test.go +++ b/backend/backend_moq_test.go @@ -81,7 +81,7 @@ var _ Backend = &BackendMock{} // ListObjectsV2Func: func(bucket string, prefix string, marker string, delim string, maxkeys int) (*s3.ListObjectsV2Output, error) { // panic("mock out the ListObjectsV2 method") // }, -// PutBucketFunc: func(bucket string) error { +// PutBucketFunc: func(bucket string, owner string) error { // panic("mock out the PutBucket method") // }, // PutBucketAclFunc: func(putBucketAclInput *s3.PutBucketAclInput) error { @@ -111,9 +111,6 @@ var _ Backend = &BackendMock{} // StringFunc: func() string { // panic("mock out the String method") // }, -// UploadPartFunc: func(bucket string, object string, uploadId string, Body io.ReadSeeker) (*s3.UploadPartOutput, error) { -// panic("mock out the UploadPart method") -// }, // UploadPartCopyFunc: func(uploadPartCopyInput *s3.UploadPartCopyInput) (*s3.UploadPartCopyOutput, error) { // panic("mock out the UploadPartCopy method") // }, @@ -185,7 +182,7 @@ type BackendMock struct { ListObjectsV2Func func(bucket string, prefix string, marker string, delim string, maxkeys int) (*s3.ListObjectsV2Output, error) // PutBucketFunc mocks the PutBucket method. - PutBucketFunc func(bucket string) error + PutBucketFunc func(bucket string, owner string) error // PutBucketAclFunc mocks the PutBucketAcl method. PutBucketAclFunc func(putBucketAclInput *s3.PutBucketAclInput) error @@ -214,9 +211,6 @@ type BackendMock struct { // StringFunc mocks the String method. StringFunc func() string - // UploadPartFunc mocks the UploadPart method. - UploadPartFunc func(bucket string, object string, uploadId string, Body io.ReadSeeker) (*s3.UploadPartOutput, error) - // UploadPartCopyFunc mocks the UploadPartCopy method. UploadPartCopyFunc func(uploadPartCopyInput *s3.UploadPartCopyInput) (*s3.UploadPartCopyOutput, error) @@ -390,6 +384,8 @@ type BackendMock struct { PutBucket []struct { // Bucket is the bucket argument value. Bucket string + // Owner is the owner argument value. + Owner string } // PutBucketAcl holds details about calls to the PutBucketAcl method. PutBucketAcl []struct { @@ -452,17 +448,6 @@ type BackendMock struct { // String holds details about calls to the String method. String []struct { } - // UploadPart holds details about calls to the UploadPart method. - UploadPart []struct { - // Bucket is the bucket argument value. - Bucket string - // Object is the object argument value. - Object string - // UploadId is the uploadId argument value. - UploadId string - // Body is the Body argument value. - Body io.ReadSeeker - } // UploadPartCopy holds details about calls to the UploadPartCopy method. UploadPartCopy []struct { // UploadPartCopyInput is the uploadPartCopyInput argument value. @@ -499,7 +484,6 @@ type BackendMock struct { lockSetTags sync.RWMutex lockShutdown sync.RWMutex lockString sync.RWMutex - lockUploadPart sync.RWMutex lockUploadPartCopy sync.RWMutex } @@ -1271,19 +1255,21 @@ func (mock *BackendMock) ListObjectsV2Calls() []struct { } // PutBucket calls PutBucketFunc. -func (mock *BackendMock) PutBucket(bucket string) error { +func (mock *BackendMock) PutBucket(bucket string, owner string) error { if mock.PutBucketFunc == nil { panic("BackendMock.PutBucketFunc: method is nil but Backend.PutBucket was just called") } callInfo := struct { Bucket string + Owner string }{ Bucket: bucket, + Owner: owner, } mock.lockPutBucket.Lock() mock.calls.PutBucket = append(mock.calls.PutBucket, callInfo) mock.lockPutBucket.Unlock() - return mock.PutBucketFunc(bucket) + return mock.PutBucketFunc(bucket, owner) } // PutBucketCalls gets all the calls that were made to PutBucket. @@ -1292,9 +1278,11 @@ func (mock *BackendMock) PutBucket(bucket string) error { // len(mockedBackend.PutBucketCalls()) func (mock *BackendMock) PutBucketCalls() []struct { Bucket string + Owner string } { var calls []struct { Bucket string + Owner string } mock.lockPutBucket.RLock() calls = mock.calls.PutBucket @@ -1620,50 +1608,6 @@ func (mock *BackendMock) StringCalls() []struct { return calls } -// UploadPart calls UploadPartFunc. -func (mock *BackendMock) UploadPart(bucket string, object string, uploadId string, Body io.ReadSeeker) (*s3.UploadPartOutput, error) { - if mock.UploadPartFunc == nil { - panic("BackendMock.UploadPartFunc: method is nil but Backend.UploadPart was just called") - } - callInfo := struct { - Bucket string - Object string - UploadId string - Body io.ReadSeeker - }{ - Bucket: bucket, - Object: object, - UploadId: uploadId, - Body: Body, - } - mock.lockUploadPart.Lock() - mock.calls.UploadPart = append(mock.calls.UploadPart, callInfo) - mock.lockUploadPart.Unlock() - return mock.UploadPartFunc(bucket, object, uploadId, Body) -} - -// UploadPartCalls gets all the calls that were made to UploadPart. -// Check the length with: -// -// len(mockedBackend.UploadPartCalls()) -func (mock *BackendMock) UploadPartCalls() []struct { - Bucket string - Object string - UploadId string - Body io.ReadSeeker -} { - var calls []struct { - Bucket string - Object string - UploadId string - Body io.ReadSeeker - } - mock.lockUploadPart.RLock() - calls = mock.calls.UploadPart - mock.lockUploadPart.RUnlock() - return calls -} - // UploadPartCopy calls UploadPartCopyFunc. func (mock *BackendMock) UploadPartCopy(uploadPartCopyInput *s3.UploadPartCopyInput) (*s3.UploadPartCopyOutput, error) { if mock.UploadPartCopyFunc == nil { diff --git a/backend/backend_test.go b/backend/backend_test.go index 41c6dc07..a4dc1b61 100644 --- a/backend/backend_test.go +++ b/backend/backend_test.go @@ -140,8 +140,9 @@ func TestBackend_GetBucketAcl(t *testing.T) { } func TestBackend_PutBucket(t *testing.T) { type args struct { - ctx context.Context - bucketName string + ctx context.Context + bucketName string + bucketOwner string } type test struct { name string @@ -153,31 +154,33 @@ func TestBackend_PutBucket(t *testing.T) { tests = append(tests, test{ name: "put bucket ", c: &BackendMock{ - PutBucketFunc: func(bucket string) error { + PutBucketFunc: func(bucket, owner string) error { return s3err.GetAPIError(0) }, }, args: args{ - ctx: context.Background(), - bucketName: "b1", + ctx: context.Background(), + bucketName: "b1", + bucketOwner: "owner", }, wantErr: false, }, test{ name: "put bucket error", c: &BackendMock{ - PutBucketFunc: func(bucket string) error { + PutBucketFunc: func(bucket, owner string) error { return s3err.GetAPIError(s3err.ErrNotImplemented) }, }, args: args{ - ctx: context.Background(), - bucketName: "b2", + ctx: context.Background(), + bucketName: "b2", + bucketOwner: "owner", }, wantErr: true, }) for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - if err := tt.c.PutBucket(tt.args.bucketName); (err.(s3err.APIError).Code != "") != tt.wantErr { + if err := tt.c.PutBucket(tt.args.bucketName, tt.args.bucketOwner); (err.(s3err.APIError).Code != "") != tt.wantErr { t.Errorf("Backend.PutBucket() error = %v, wantErr %v", err, tt.wantErr) } }) diff --git a/backend/posix/posix.go b/backend/posix/posix.go index 68cd269f..81c0408a 100644 --- a/backend/posix/posix.go +++ b/backend/posix/posix.go @@ -35,6 +35,7 @@ import ( "github.com/google/uuid" "github.com/pkg/xattr" "github.com/versity/versitygw/backend" + "github.com/versity/versitygw/backend/auth" "github.com/versity/versitygw/s3err" "github.com/versity/versitygw/s3response" ) @@ -121,7 +122,7 @@ func (p *Posix) HeadBucket(bucket string) (*s3.HeadBucketOutput, error) { return &s3.HeadBucketOutput{}, nil } -func (p *Posix) PutBucket(bucket string) error { +func (p *Posix) PutBucket(bucket string, owner string) error { err := os.Mkdir(bucket, 0777) if err != nil && os.IsExist(err) { return s3err.GetAPIError(s3err.ErrBucketAlreadyExists) @@ -130,6 +131,16 @@ func (p *Posix) PutBucket(bucket string) error { return fmt.Errorf("mkdir bucket: %w", err) } + acl := auth.ACL{ACL: "private", Owner: owner, Grantees: []auth.Grantee{}} + jsonACL, err := json.Marshal(acl) + if err != nil { + return fmt.Errorf("marshal acl: %w", err) + } + + if err := xattr.Set(bucket, "user.acl", jsonACL); err != nil { + return fmt.Errorf("set acl: %w", err) + } + return nil } @@ -1088,6 +1099,120 @@ func (p *Posix) ListObjectsV2(bucket, prefix, marker, delim string, maxkeys int) }, nil } +func (p *Posix) PutBucketAcl(input *s3.PutBucketAclInput) error { + var ACL auth.ACL + acl, err := xattr.Get(*input.Bucket, "user.acl") + if err != nil { + return fmt.Errorf("get acl: %w", err) + } + + if err := json.Unmarshal(acl, &ACL); err != nil { + return fmt.Errorf("parse acl: %w", err) + } + + if ACL.Owner != *input.AccessControlPolicy.Owner.ID { + return s3err.GetAPIError(s3err.ErrAccessDenied) + } + + grantees := []auth.Grantee{} + + fullControlList, readList, readACPList, writeList, writeACPList := []string{}, []string{}, []string{}, []string{}, []string{} + + if *input.GrantFullControl != "" { + fullControlList = strings.Split(*input.GrantFullControl, ",") + for _, str := range fullControlList { + grantees = append(grantees, auth.Grantee{Access: str, Permission: "FULL_CONTROL"}) + } + } + if *input.GrantRead != "" { + readList = strings.Split(*input.GrantRead, ",") + for _, str := range readList { + grantees = append(grantees, auth.Grantee{Access: str, Permission: "READ"}) + } + } + if *input.GrantReadACP != "" { + readACPList = strings.Split(*input.GrantReadACP, ",") + for _, str := range readACPList { + grantees = append(grantees, auth.Grantee{Access: str, Permission: "READ_ACP"}) + } + } + if *input.GrantWrite != "" { + writeList = strings.Split(*input.GrantWrite, ",") + for _, str := range writeList { + grantees = append(grantees, auth.Grantee{Access: str, Permission: "WRITE"}) + } + } + if *input.GrantWriteACP != "" { + writeACPList = strings.Split(*input.GrantWriteACP, ",") + for _, str := range writeACPList { + grantees = append(grantees, auth.Grantee{Access: str, Permission: "WRITE_ACP"}) + } + } + + accs := append(append(append(append(fullControlList, readList...), writeACPList...), readACPList...), writeList...) + + accList, err := checkIfAccountsExist(accs) + if err != nil { + return err + } + if len(accList) > 0 { + return fmt.Errorf("Accounts does not exist: %s", strings.Join(accList, ", ")) + } + + for _, elem := range grantees { + doesContain := false + for _, grantee := range ACL.Grantees { + if elem == grantee { + doesContain = true + break + } + } + if !doesContain { + ACL.Grantees = append(ACL.Grantees, elem) + } + } + + if input.ACL != "" { + ACL.ACL = input.ACL + } + + ACLJson, err := json.Marshal(ACL) + if err != nil { + return fmt.Errorf("parsing error: %w", err) + } + + if err := xattr.Set(*input.Bucket, "user.acl", ACLJson); err != nil { + return fmt.Errorf("set acl: %w", err) + } + + return nil +} + +func (p *Posix) GetBucketAcl(bucket string) (*s3.GetBucketAclOutput, error) { + var ACL auth.ACL + acl, err := xattr.Get(bucket, "user.acl") + if err != nil { + return nil, fmt.Errorf("get acl: %w", err) + } + + if err := json.Unmarshal(acl, &ACL); err != nil { + return nil, fmt.Errorf("parse acl: %w", err) + } + + grants := []types.Grant{} + + for _, elem := range ACL.Grantees { + grants = append(grants, types.Grant{Grantee: &types.Grantee{ID: &elem.Access}, Permission: elem.Permission}) + } + + return &s3.GetBucketAclOutput{ + Owner: &types.Owner{ + ID: &ACL.Owner, + }, + Grants: grants, + }, nil +} + func (p *Posix) GetTags(bucket, object string) (map[string]string, error) { _, err := os.Stat(bucket) if errors.Is(err, fs.ErrNotExist) { @@ -1174,3 +1299,25 @@ func isNoAttr(err error) bool { } return false } + +func checkIfAccountsExist(accs []string) ([]string, error) { + var data auth.IAMConfig + result := []string{} + + file, err := os.ReadFile("users.json") + if err != nil { + return []string{}, fmt.Errorf("unable to read config file: %w", err) + } + + if err := json.Unmarshal(file, &data); err != nil { + return []string{}, err + } + + for _, acc := range accs { + _, ok := data.AccessAccounts[acc] + if !ok { + result = append(result, acc) + } + } + return result, nil +} diff --git a/s3api/controllers/backend_moq_test.go b/s3api/controllers/backend_moq_test.go index 4e6b425c..f1fcbcb5 100644 --- a/s3api/controllers/backend_moq_test.go +++ b/s3api/controllers/backend_moq_test.go @@ -82,7 +82,7 @@ var _ backend.Backend = &BackendMock{} // ListObjectsV2Func: func(bucket string, prefix string, marker string, delim string, maxkeys int) (*s3.ListObjectsV2Output, error) { // panic("mock out the ListObjectsV2 method") // }, -// PutBucketFunc: func(bucket string) error { +// PutBucketFunc: func(bucket string, owner string) error { // panic("mock out the PutBucket method") // }, // PutBucketAclFunc: func(putBucketAclInput *s3.PutBucketAclInput) error { @@ -112,9 +112,6 @@ var _ backend.Backend = &BackendMock{} // StringFunc: func() string { // panic("mock out the String method") // }, -// UploadPartFunc: func(bucket string, object string, uploadId string, Body io.ReadSeeker) (*s3.UploadPartOutput, error) { -// panic("mock out the UploadPart method") -// }, // UploadPartCopyFunc: func(uploadPartCopyInput *s3.UploadPartCopyInput) (*s3.UploadPartCopyOutput, error) { // panic("mock out the UploadPartCopy method") // }, @@ -186,7 +183,7 @@ type BackendMock struct { ListObjectsV2Func func(bucket string, prefix string, marker string, delim string, maxkeys int) (*s3.ListObjectsV2Output, error) // PutBucketFunc mocks the PutBucket method. - PutBucketFunc func(bucket string) error + PutBucketFunc func(bucket string, owner string) error // PutBucketAclFunc mocks the PutBucketAcl method. PutBucketAclFunc func(putBucketAclInput *s3.PutBucketAclInput) error @@ -215,9 +212,6 @@ type BackendMock struct { // StringFunc mocks the String method. StringFunc func() string - // UploadPartFunc mocks the UploadPart method. - UploadPartFunc func(bucket string, object string, uploadId string, Body io.ReadSeeker) (*s3.UploadPartOutput, error) - // UploadPartCopyFunc mocks the UploadPartCopy method. UploadPartCopyFunc func(uploadPartCopyInput *s3.UploadPartCopyInput) (*s3.UploadPartCopyOutput, error) @@ -391,6 +385,8 @@ type BackendMock struct { PutBucket []struct { // Bucket is the bucket argument value. Bucket string + // Owner is the owner argument value. + Owner string } // PutBucketAcl holds details about calls to the PutBucketAcl method. PutBucketAcl []struct { @@ -453,17 +449,6 @@ type BackendMock struct { // String holds details about calls to the String method. String []struct { } - // UploadPart holds details about calls to the UploadPart method. - UploadPart []struct { - // Bucket is the bucket argument value. - Bucket string - // Object is the object argument value. - Object string - // UploadId is the uploadId argument value. - UploadId string - // Body is the Body argument value. - Body io.ReadSeeker - } // UploadPartCopy holds details about calls to the UploadPartCopy method. UploadPartCopy []struct { // UploadPartCopyInput is the uploadPartCopyInput argument value. @@ -500,7 +485,6 @@ type BackendMock struct { lockSetTags sync.RWMutex lockShutdown sync.RWMutex lockString sync.RWMutex - lockUploadPart sync.RWMutex lockUploadPartCopy sync.RWMutex } @@ -1272,19 +1256,21 @@ func (mock *BackendMock) ListObjectsV2Calls() []struct { } // PutBucket calls PutBucketFunc. -func (mock *BackendMock) PutBucket(bucket string) error { +func (mock *BackendMock) PutBucket(bucket string, owner string) error { if mock.PutBucketFunc == nil { panic("BackendMock.PutBucketFunc: method is nil but Backend.PutBucket was just called") } callInfo := struct { Bucket string + Owner string }{ Bucket: bucket, + Owner: owner, } mock.lockPutBucket.Lock() mock.calls.PutBucket = append(mock.calls.PutBucket, callInfo) mock.lockPutBucket.Unlock() - return mock.PutBucketFunc(bucket) + return mock.PutBucketFunc(bucket, owner) } // PutBucketCalls gets all the calls that were made to PutBucket. @@ -1293,9 +1279,11 @@ func (mock *BackendMock) PutBucket(bucket string) error { // len(mockedBackend.PutBucketCalls()) func (mock *BackendMock) PutBucketCalls() []struct { Bucket string + Owner string } { var calls []struct { Bucket string + Owner string } mock.lockPutBucket.RLock() calls = mock.calls.PutBucket @@ -1621,50 +1609,6 @@ func (mock *BackendMock) StringCalls() []struct { return calls } -// UploadPart calls UploadPartFunc. -func (mock *BackendMock) UploadPart(bucket string, object string, uploadId string, Body io.ReadSeeker) (*s3.UploadPartOutput, error) { - if mock.UploadPartFunc == nil { - panic("BackendMock.UploadPartFunc: method is nil but Backend.UploadPart was just called") - } - callInfo := struct { - Bucket string - Object string - UploadId string - Body io.ReadSeeker - }{ - Bucket: bucket, - Object: object, - UploadId: uploadId, - Body: Body, - } - mock.lockUploadPart.Lock() - mock.calls.UploadPart = append(mock.calls.UploadPart, callInfo) - mock.lockUploadPart.Unlock() - return mock.UploadPartFunc(bucket, object, uploadId, Body) -} - -// UploadPartCalls gets all the calls that were made to UploadPart. -// Check the length with: -// -// len(mockedBackend.UploadPartCalls()) -func (mock *BackendMock) UploadPartCalls() []struct { - Bucket string - Object string - UploadId string - Body io.ReadSeeker -} { - var calls []struct { - Bucket string - Object string - UploadId string - Body io.ReadSeeker - } - mock.lockUploadPart.RLock() - calls = mock.calls.UploadPart - mock.lockUploadPart.RUnlock() - return calls -} - // UploadPartCopy calls UploadPartCopyFunc. func (mock *BackendMock) UploadPartCopy(uploadPartCopyInput *s3.UploadPartCopyInput) (*s3.UploadPartCopyOutput, error) { if mock.UploadPartCopyFunc == nil { diff --git a/s3api/controllers/base.go b/s3api/controllers/base.go index 11f237d6..b199796c 100644 --- a/s3api/controllers/base.go +++ b/s3api/controllers/base.go @@ -152,15 +152,17 @@ func (c S3ApiController) ListActions(ctx *fiber.Ctx) error { } func (c S3ApiController) PutBucketActions(ctx *fiber.Ctx) error { - bucket, acl, grantFullControl, grantRead, grantReadACP, granWrite, grantWriteACP := + bucket, acl, grantFullControl, grantRead, grantReadACP, granWrite, grantWriteACP, access := ctx.Params("bucket"), ctx.Get("X-Amz-Acl"), ctx.Get("X-Amz-Grant-Full-Control"), ctx.Get("X-Amz-Grant-Read"), ctx.Get("X-Amz-Grant-Read-Acp"), ctx.Get("X-Amz-Grant-Write"), - ctx.Get("X-Amz-Grant-Write-Acp") + ctx.Get("X-Amz-Grant-Write-Acp"), + ctx.Locals("access") + owner := access.(string) grants := grantFullControl + grantRead + grantReadACP + granWrite + grantWriteACP if grants != "" || acl != "" { @@ -168,19 +170,20 @@ func (c S3ApiController) PutBucketActions(ctx *fiber.Ctx) error { return errors.New("wrong api call") } err := c.be.PutBucketAcl(&s3.PutBucketAclInput{ - Bucket: &bucket, - ACL: types.BucketCannedACL(acl), - GrantFullControl: &grantFullControl, - GrantRead: &grantRead, - GrantReadACP: &grantReadACP, - GrantWrite: &granWrite, - GrantWriteACP: &grantWriteACP, + Bucket: &bucket, + ACL: types.BucketCannedACL(acl), + GrantFullControl: &grantFullControl, + GrantRead: &grantRead, + GrantReadACP: &grantReadACP, + GrantWrite: &granWrite, + GrantWriteACP: &grantWriteACP, + AccessControlPolicy: &types.AccessControlPolicy{Owner: &types.Owner{ID: &owner}}, }) return SendResponse(ctx, err) } - err := c.be.PutBucket(bucket) + err := c.be.PutBucket(bucket, owner) return SendResponse(ctx, err) } diff --git a/s3api/controllers/base_test.go b/s3api/controllers/base_test.go index e88f6083..c4af7e8e 100644 --- a/s3api/controllers/base_test.go +++ b/s3api/controllers/base_test.go @@ -232,7 +232,7 @@ func TestS3ApiController_ListActions(t *testing.T) { app := fiber.New() s3ApiController := S3ApiController{be: &BackendMock{ GetBucketAclFunc: func(bucket string) (*s3.GetBucketAclOutput, error) { - return &s3.GetBucketAclOutput{}, nil + return nil, nil }, ListMultipartUploadsFunc: func(output *s3.ListMultipartUploadsInput) (s3response.ListMultipartUploadsResponse, error) { return s3response.ListMultipartUploadsResponse{}, nil @@ -333,7 +333,7 @@ func TestS3ApiController_PutBucketActions(t *testing.T) { PutBucketAclFunc: func(*s3.PutBucketAclInput) error { return nil }, - PutBucketFunc: func(bucket string) error { + PutBucketFunc: func(bucket, owner string) error { return nil }, }} @@ -406,9 +406,6 @@ func TestS3ApiController_PutActions(t *testing.T) { UploadPartCopyFunc: func(*s3.UploadPartCopyInput) (*s3.UploadPartCopyOutput, error) { return &s3.UploadPartCopyOutput{}, nil }, - UploadPartFunc: func(bucket, object, uploadId string, Body io.ReadSeeker) (*s3.UploadPartOutput, error) { - return &s3.UploadPartOutput{}, nil - }, PutObjectAclFunc: func(*s3.PutObjectAclInput) error { return nil }, diff --git a/s3api/middlewares/authentication.go b/s3api/middlewares/authentication.go index 90f11951..c3faeee2 100644 --- a/s3api/middlewares/authentication.go +++ b/s3api/middlewares/authentication.go @@ -68,7 +68,7 @@ func VerifyV4Signature(root RootUserConfig, iam auth.IAMService, debug bool) fib return controllers.SendResponse(ctx, s3err.GetAPIError(s3err.ErrCredMalformed)) } - signHdrKv := strings.Split(authParts[2], "=") + signHdrKv := strings.Split(authParts[2][:len(authParts[2])-1], "=") if len(signHdrKv) != 2 { return controllers.SendResponse(ctx, s3err.GetAPIError(s3err.ErrCredMalformed)) } @@ -135,6 +135,7 @@ func VerifyV4Signature(root RootUserConfig, iam auth.IAMService, debug bool) fib } ctx.Locals("role", account.Role) + ctx.Locals("access", creds[0]) return ctx.Next() } From 3d7ce4210a548d3d1ed5052d0d802f627227c01a Mon Sep 17 00:00:00 2001 From: jonaustin09 Date: Thu, 15 Jun 2023 20:39:20 +0400 Subject: [PATCH 2/3] fix: Fixed GetBucketAcl return type, fixed staticcheck uppercase error, fixed unit tests for PutActions --- backend/auth/acl.go | 9 +++++++++ backend/backend.go | 5 +++-- backend/backend_moq_test.go | 7 ++++--- backend/backend_test.go | 3 ++- backend/posix/posix.go | 10 ++++++---- s3api/controllers/backend_moq_test.go | 7 ++++--- s3api/controllers/base_test.go | 8 +++++++- 7 files changed, 35 insertions(+), 14 deletions(-) diff --git a/backend/auth/acl.go b/backend/auth/acl.go index 21f344bd..81400025 100644 --- a/backend/auth/acl.go +++ b/backend/auth/acl.go @@ -26,3 +26,12 @@ type Grantee struct { Permission types.Permission Access string } + +type GetBucketAclOutput struct { + Owner *types.Owner + AccessControlList AccessControlList +} + +type AccessControlList struct { + Grants []types.Grant +} diff --git a/backend/backend.go b/backend/backend.go index a778d5d8..ee5bb480 100644 --- a/backend/backend.go +++ b/backend/backend.go @@ -20,6 +20,7 @@ import ( "github.com/aws/aws-sdk-go-v2/service/s3" "github.com/aws/aws-sdk-go-v2/service/s3/types" + "github.com/versity/versitygw/backend/auth" "github.com/versity/versitygw/s3err" "github.com/versity/versitygw/s3response" ) @@ -32,7 +33,7 @@ type Backend interface { ListBuckets() (*s3.ListBucketsOutput, error) HeadBucket(bucket string) (*s3.HeadBucketOutput, error) - GetBucketAcl(bucket string) (*s3.GetBucketAclOutput, error) + GetBucketAcl(bucket string) (*auth.GetBucketAclOutput, error) PutBucket(bucket, owner string) error PutBucketAcl(*s3.PutBucketAclInput) error DeleteBucket(bucket string) error @@ -90,7 +91,7 @@ func (BackendUnsupported) RestoreObject(bucket, object string, restoreRequest *s func (BackendUnsupported) UploadPartCopy(*s3.UploadPartCopyInput) (*s3.UploadPartCopyOutput, error) { return nil, s3err.GetAPIError(s3err.ErrNotImplemented) } -func (BackendUnsupported) GetBucketAcl(bucket string) (*s3.GetBucketAclOutput, error) { +func (BackendUnsupported) GetBucketAcl(bucket string) (*auth.GetBucketAclOutput, error) { return nil, s3err.GetAPIError(s3err.ErrNotImplemented) } func (BackendUnsupported) HeadBucket(bucket string) (*s3.HeadBucketOutput, error) { diff --git a/backend/backend_moq_test.go b/backend/backend_moq_test.go index 398133b1..f3a88d37 100644 --- a/backend/backend_moq_test.go +++ b/backend/backend_moq_test.go @@ -6,6 +6,7 @@ package backend import ( "github.com/aws/aws-sdk-go-v2/service/s3" "github.com/aws/aws-sdk-go-v2/service/s3/types" + "github.com/versity/versitygw/backend/auth" "github.com/versity/versitygw/s3response" "io" "sync" @@ -45,7 +46,7 @@ var _ Backend = &BackendMock{} // DeleteObjectsFunc: func(bucket string, objects *s3.DeleteObjectsInput) error { // panic("mock out the DeleteObjects method") // }, -// GetBucketAclFunc: func(bucket string) (*s3.GetBucketAclOutput, error) { +// GetBucketAclFunc: func(bucket string) (*auth.GetBucketAclOutput, error) { // panic("mock out the GetBucketAcl method") // }, // GetObjectFunc: func(bucket string, object string, acceptRange string, writer io.Writer) (*s3.GetObjectOutput, error) { @@ -146,7 +147,7 @@ type BackendMock struct { DeleteObjectsFunc func(bucket string, objects *s3.DeleteObjectsInput) error // GetBucketAclFunc mocks the GetBucketAcl method. - GetBucketAclFunc func(bucket string) (*s3.GetBucketAclOutput, error) + GetBucketAclFunc func(bucket string) (*auth.GetBucketAclOutput, error) // GetObjectFunc mocks the GetObject method. GetObjectFunc func(bucket string, object string, acceptRange string, writer io.Writer) (*s3.GetObjectOutput, error) @@ -796,7 +797,7 @@ func (mock *BackendMock) DeleteObjectsCalls() []struct { } // GetBucketAcl calls GetBucketAclFunc. -func (mock *BackendMock) GetBucketAcl(bucket string) (*s3.GetBucketAclOutput, error) { +func (mock *BackendMock) GetBucketAcl(bucket string) (*auth.GetBucketAclOutput, error) { if mock.GetBucketAclFunc == nil { panic("BackendMock.GetBucketAclFunc: method is nil but Backend.GetBucketAcl was just called") } diff --git a/backend/backend_test.go b/backend/backend_test.go index a4dc1b61..62515f54 100644 --- a/backend/backend_test.go +++ b/backend/backend_test.go @@ -21,6 +21,7 @@ import ( "github.com/aws/aws-sdk-go-v2/aws" "github.com/aws/aws-sdk-go-v2/service/s3" "github.com/aws/aws-sdk-go-v2/service/s3/types" + "github.com/versity/versitygw/backend/auth" "github.com/versity/versitygw/s3err" ) @@ -120,7 +121,7 @@ func TestBackend_GetBucketAcl(t *testing.T) { tests = append(tests, test{ name: "get bucket acl error", c: &BackendMock{ - GetBucketAclFunc: func(bucket string) (*s3.GetBucketAclOutput, error) { + GetBucketAclFunc: func(bucket string) (*auth.GetBucketAclOutput, error) { return nil, s3err.GetAPIError(s3err.ErrNotImplemented) }, }, diff --git a/backend/posix/posix.go b/backend/posix/posix.go index 81c0408a..79690f9a 100644 --- a/backend/posix/posix.go +++ b/backend/posix/posix.go @@ -1156,7 +1156,7 @@ func (p *Posix) PutBucketAcl(input *s3.PutBucketAclInput) error { return err } if len(accList) > 0 { - return fmt.Errorf("Accounts does not exist: %s", strings.Join(accList, ", ")) + return fmt.Errorf("accounts does not exist: %s", strings.Join(accList, ", ")) } for _, elem := range grantees { @@ -1188,7 +1188,7 @@ func (p *Posix) PutBucketAcl(input *s3.PutBucketAclInput) error { return nil } -func (p *Posix) GetBucketAcl(bucket string) (*s3.GetBucketAclOutput, error) { +func (p *Posix) GetBucketAcl(bucket string) (*auth.GetBucketAclOutput, error) { var ACL auth.ACL acl, err := xattr.Get(bucket, "user.acl") if err != nil { @@ -1205,11 +1205,13 @@ func (p *Posix) GetBucketAcl(bucket string) (*s3.GetBucketAclOutput, error) { grants = append(grants, types.Grant{Grantee: &types.Grantee{ID: &elem.Access}, Permission: elem.Permission}) } - return &s3.GetBucketAclOutput{ + return &auth.GetBucketAclOutput{ Owner: &types.Owner{ ID: &ACL.Owner, }, - Grants: grants, + AccessControlList: auth.AccessControlList{ + Grants: grants, + }, }, nil } diff --git a/s3api/controllers/backend_moq_test.go b/s3api/controllers/backend_moq_test.go index f1fcbcb5..0d958dad 100644 --- a/s3api/controllers/backend_moq_test.go +++ b/s3api/controllers/backend_moq_test.go @@ -7,6 +7,7 @@ import ( "github.com/aws/aws-sdk-go-v2/service/s3" "github.com/aws/aws-sdk-go-v2/service/s3/types" "github.com/versity/versitygw/backend" + "github.com/versity/versitygw/backend/auth" "github.com/versity/versitygw/s3response" "io" "sync" @@ -46,7 +47,7 @@ var _ backend.Backend = &BackendMock{} // DeleteObjectsFunc: func(bucket string, objects *s3.DeleteObjectsInput) error { // panic("mock out the DeleteObjects method") // }, -// GetBucketAclFunc: func(bucket string) (*s3.GetBucketAclOutput, error) { +// GetBucketAclFunc: func(bucket string) (*auth.GetBucketAclOutput, error) { // panic("mock out the GetBucketAcl method") // }, // GetObjectFunc: func(bucket string, object string, acceptRange string, writer io.Writer) (*s3.GetObjectOutput, error) { @@ -147,7 +148,7 @@ type BackendMock struct { DeleteObjectsFunc func(bucket string, objects *s3.DeleteObjectsInput) error // GetBucketAclFunc mocks the GetBucketAcl method. - GetBucketAclFunc func(bucket string) (*s3.GetBucketAclOutput, error) + GetBucketAclFunc func(bucket string) (*auth.GetBucketAclOutput, error) // GetObjectFunc mocks the GetObject method. GetObjectFunc func(bucket string, object string, acceptRange string, writer io.Writer) (*s3.GetObjectOutput, error) @@ -797,7 +798,7 @@ func (mock *BackendMock) DeleteObjectsCalls() []struct { } // GetBucketAcl calls GetBucketAclFunc. -func (mock *BackendMock) GetBucketAcl(bucket string) (*s3.GetBucketAclOutput, error) { +func (mock *BackendMock) GetBucketAcl(bucket string) (*auth.GetBucketAclOutput, error) { if mock.GetBucketAclFunc == nil { panic("BackendMock.GetBucketAclFunc: method is nil but Backend.GetBucketAcl was just called") } diff --git a/s3api/controllers/base_test.go b/s3api/controllers/base_test.go index c4af7e8e..c92beadf 100644 --- a/s3api/controllers/base_test.go +++ b/s3api/controllers/base_test.go @@ -28,6 +28,7 @@ import ( "github.com/gofiber/fiber/v2" "github.com/valyala/fasthttp" "github.com/versity/versitygw/backend" + "github.com/versity/versitygw/backend/auth" "github.com/versity/versitygw/s3err" "github.com/versity/versitygw/s3response" ) @@ -231,7 +232,7 @@ func TestS3ApiController_ListActions(t *testing.T) { app := fiber.New() s3ApiController := S3ApiController{be: &BackendMock{ - GetBucketAclFunc: func(bucket string) (*s3.GetBucketAclOutput, error) { + GetBucketAclFunc: func(bucket string) (*auth.GetBucketAclOutput, error) { return nil, nil }, ListMultipartUploadsFunc: func(output *s3.ListMultipartUploadsInput) (s3response.ListMultipartUploadsResponse, error) { @@ -337,6 +338,11 @@ func TestS3ApiController_PutBucketActions(t *testing.T) { return nil }, }} + // Mock ctx.Locals + app.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + return ctx.Next() + }) app.Put("/:bucket", s3ApiController.PutBucketActions) // Error case From 49af6f0049358dbc472ef7db17739c1509092307 Mon Sep 17 00:00:00 2001 From: jonaustin09 Date: Fri, 16 Jun 2023 20:55:23 +0400 Subject: [PATCH 3/3] feat: ACL set up finished: added VerifyACL function, added admin checker function on list buckets, fixed all the unit tests --- backend/auth/acl.go | 95 ++++++- backend/posix/posix.go | 128 ++++----- s3api/controllers/base.go | 132 +++++++++- s3api/controllers/base_test.go | 385 +++++++++++++++++++--------- s3api/middlewares/authentication.go | 1 + 5 files changed, 548 insertions(+), 193 deletions(-) diff --git a/backend/auth/acl.go b/backend/auth/acl.go index 81400025..168e3cd0 100644 --- a/backend/auth/acl.go +++ b/backend/auth/acl.go @@ -14,7 +14,15 @@ package auth -import "github.com/aws/aws-sdk-go-v2/service/s3/types" +import ( + "encoding/json" + "fmt" + "os" + + "github.com/aws/aws-sdk-go-v2/service/s3/types" + "github.com/pkg/xattr" + "github.com/versity/versitygw/s3err" +) type ACL struct { ACL types.BucketCannedACL @@ -35,3 +43,88 @@ type GetBucketAclOutput struct { type AccessControlList struct { Grants []types.Grant } + +type ACLService interface { + VerifyACL(bucket, access string, permission types.Permission, isRoot bool) error + IsAdmin(access string, isRoot bool) error +} + +type ACLServiceUnsupported struct{} + +var _ ACLService = &ACLServiceUnsupported{} + +func (ACLServiceUnsupported) VerifyACL(bucket, access string, permission types.Permission, isRoot bool) error { + var ACL ACL + + if isRoot { + return nil + } + + acl, err := xattr.Get(bucket, "user.acl") + if err != nil { + return fmt.Errorf("get acl: %w", err) + } + + if err := json.Unmarshal(acl, &ACL); err != nil { + return fmt.Errorf("parse acl: %w", err) + } + if ACL.Owner == access { + return nil + } + + if ACL.ACL != "" { + if (permission == "READ" || permission == "READ_ACP") && (ACL.ACL != "public-read" && ACL.ACL != "public-read-write") { + return s3err.GetAPIError(s3err.ErrAccessDenied) + } + if (permission == "WRITE" || permission == "WRITE_ACP") && ACL.ACL != "public-read-write" { + return s3err.GetAPIError(s3err.ErrAccessDenied) + } + + return nil + } else { + grantee := Grantee{Access: access, Permission: permission} + granteeFullCtrl := Grantee{Access: access, Permission: "FULL_CONTROL"} + + isFound := false + + for _, grt := range ACL.Grantees { + if grt == grantee || grt == granteeFullCtrl { + isFound = true + break + } + } + + if isFound { + return nil + } + } + + return s3err.GetAPIError(s3err.ErrAccessDenied) +} + +func (ACLServiceUnsupported) IsAdmin(access string, isRoot bool) error { + var data IAMConfig + + if isRoot { + return nil + } + + file, err := os.ReadFile("users.json") + if err != nil { + return fmt.Errorf("unable to read config file: %w", err) + } + + if err := json.Unmarshal(file, &data); err != nil { + return err + } + + acc, ok := data.AccessAccounts[access] + if !ok { + return fmt.Errorf("user does not exist") + } + + if acc.Role == "admin" { + return nil + } + return fmt.Errorf("only admin users have access to this resource") +} diff --git a/backend/posix/posix.go b/backend/posix/posix.go index 79690f9a..4231c551 100644 --- a/backend/posix/posix.go +++ b/backend/posix/posix.go @@ -1114,66 +1114,60 @@ func (p *Posix) PutBucketAcl(input *s3.PutBucketAclInput) error { return s3err.GetAPIError(s3err.ErrAccessDenied) } - grantees := []auth.Grantee{} - - fullControlList, readList, readACPList, writeList, writeACPList := []string{}, []string{}, []string{}, []string{}, []string{} - - if *input.GrantFullControl != "" { - fullControlList = strings.Split(*input.GrantFullControl, ",") - for _, str := range fullControlList { - grantees = append(grantees, auth.Grantee{Access: str, Permission: "FULL_CONTROL"}) - } - } - if *input.GrantRead != "" { - readList = strings.Split(*input.GrantRead, ",") - for _, str := range readList { - grantees = append(grantees, auth.Grantee{Access: str, Permission: "READ"}) - } - } - if *input.GrantReadACP != "" { - readACPList = strings.Split(*input.GrantReadACP, ",") - for _, str := range readACPList { - grantees = append(grantees, auth.Grantee{Access: str, Permission: "READ_ACP"}) - } - } - if *input.GrantWrite != "" { - writeList = strings.Split(*input.GrantWrite, ",") - for _, str := range writeList { - grantees = append(grantees, auth.Grantee{Access: str, Permission: "WRITE"}) - } - } - if *input.GrantWriteACP != "" { - writeACPList = strings.Split(*input.GrantWriteACP, ",") - for _, str := range writeACPList { - grantees = append(grantees, auth.Grantee{Access: str, Permission: "WRITE_ACP"}) - } - } - - accs := append(append(append(append(fullControlList, readList...), writeACPList...), readACPList...), writeList...) - - accList, err := checkIfAccountsExist(accs) - if err != nil { - return err - } - if len(accList) > 0 { - return fmt.Errorf("accounts does not exist: %s", strings.Join(accList, ", ")) - } - - for _, elem := range grantees { - doesContain := false - for _, grantee := range ACL.Grantees { - if elem == grantee { - doesContain = true - break - } - } - if !doesContain { - ACL.Grantees = append(ACL.Grantees, elem) - } - } - + // if the ACL is specified, set the ACL, else replace the grantees if input.ACL != "" { ACL.ACL = input.ACL + ACL.Grantees = []auth.Grantee{} + } else { + grantees := []auth.Grantee{} + + fullControlList, readList, readACPList, writeList, writeACPList := []string{}, []string{}, []string{}, []string{}, []string{} + + if *input.GrantFullControl != "" { + fullControlList = splitUnique(*input.GrantFullControl, ",") + fmt.Println(fullControlList) + for _, str := range fullControlList { + grantees = append(grantees, auth.Grantee{Access: str, Permission: "FULL_CONTROL"}) + } + } + if *input.GrantRead != "" { + readList = splitUnique(*input.GrantRead, ",") + for _, str := range readList { + grantees = append(grantees, auth.Grantee{Access: str, Permission: "READ"}) + } + } + if *input.GrantReadACP != "" { + readACPList = splitUnique(*input.GrantReadACP, ",") + for _, str := range readACPList { + grantees = append(grantees, auth.Grantee{Access: str, Permission: "READ_ACP"}) + } + } + if *input.GrantWrite != "" { + writeList = splitUnique(*input.GrantWrite, ",") + for _, str := range writeList { + grantees = append(grantees, auth.Grantee{Access: str, Permission: "WRITE"}) + } + } + if *input.GrantWriteACP != "" { + writeACPList = splitUnique(*input.GrantWriteACP, ",") + for _, str := range writeACPList { + grantees = append(grantees, auth.Grantee{Access: str, Permission: "WRITE_ACP"}) + } + } + + accs := append(append(append(append(fullControlList, readList...), writeACPList...), readACPList...), writeList...) + + // Check if the specified accounts exist + accList, err := checkIfAccountsExist(accs) + if err != nil { + return err + } + if len(accList) > 0 { + return fmt.Errorf("accounts does not exist: %s", strings.Join(accList, ", ")) + } + + ACL.Grantees = grantees + ACL.ACL = "" } ACLJson, err := json.Marshal(ACL) @@ -1202,7 +1196,8 @@ func (p *Posix) GetBucketAcl(bucket string) (*auth.GetBucketAclOutput, error) { grants := []types.Grant{} for _, elem := range ACL.Grantees { - grants = append(grants, types.Grant{Grantee: &types.Grantee{ID: &elem.Access}, Permission: elem.Permission}) + acs := elem.Access + grants = append(grants, types.Grant{Grantee: &types.Grantee{ID: &acs}, Permission: elem.Permission}) } return &auth.GetBucketAclOutput{ @@ -1323,3 +1318,18 @@ func checkIfAccountsExist(accs []string) ([]string, error) { } return result, nil } + +func splitUnique(s, divider string) []string { + elements := strings.Split(s, divider) + uniqueElements := make(map[string]bool) + result := make([]string, 0, len(elements)) + + for _, element := range elements { + if _, ok := uniqueElements[element]; !ok { + result = append(result, element) + uniqueElements[element] = true + } + } + + return result +} diff --git a/s3api/controllers/base.go b/s3api/controllers/base.go index b38c4432..9d32cc58 100644 --- a/s3api/controllers/base.go +++ b/s3api/controllers/base.go @@ -30,19 +30,25 @@ import ( "github.com/aws/aws-sdk-go-v2/service/s3/types" "github.com/gofiber/fiber/v2" "github.com/versity/versitygw/backend" + "github.com/versity/versitygw/backend/auth" "github.com/versity/versitygw/s3api/utils" "github.com/versity/versitygw/s3err" ) type S3ApiController struct { - be backend.Backend + be backend.Backend + acl auth.ACLService } func New(be backend.Backend) S3ApiController { - return S3ApiController{be: be} + return S3ApiController{be: be, acl: auth.ACLServiceUnsupported{}} } func (c S3ApiController) ListBuckets(ctx *fiber.Ctx) error { + access, isRoot := ctx.Locals("access").(string), ctx.Locals("isRoot").(bool) + if err := c.acl.IsAdmin(access, isRoot); err != nil { + return SendXMLResponse(ctx, nil, err) + } res, err := c.be.ListBuckets() return SendXMLResponse(ctx, res, err) } @@ -55,6 +61,8 @@ func (c S3ApiController) GetActions(ctx *fiber.Ctx) error { maxParts := ctx.QueryInt("max-parts", 0) partNumberMarker := ctx.QueryInt("part-number-marker", 0) acceptRange := ctx.Get("Range") + access := ctx.Locals("access").(string) + isRoot := ctx.Locals("isRoot").(bool) if keyEnd != "" { key = strings.Join([]string{key, keyEnd}, "/") } @@ -66,20 +74,35 @@ func (c S3ApiController) GetActions(ctx *fiber.Ctx) error { if partNumberMarker < 0 || (partNumberMarker == 0 && ctx.Query("part-number-marker") != "") { return SendResponse(ctx, s3err.GetAPIError(s3err.ErrInvalidPartNumberMarker)) } + + if err := c.acl.VerifyACL(bucket, access, "READ", isRoot); err != nil { + return SendXMLResponse(ctx, nil, err) + } + res, err := c.be.ListObjectParts(bucket, key, uploadId, partNumberMarker, maxParts) return SendXMLResponse(ctx, res, err) } if ctx.Request().URI().QueryArgs().Has("acl") { + if err := c.acl.VerifyACL(bucket, access, "READ_ACP", isRoot); err != nil { + return SendXMLResponse(ctx, nil, err) + } res, err := c.be.GetObjectAcl(bucket, key) return SendXMLResponse(ctx, res, err) } if attrs := ctx.Get("X-Amz-Object-Attributes"); attrs != "" { + if err := c.acl.VerifyACL(bucket, access, "READ", isRoot); err != nil { + return SendXMLResponse(ctx, nil, err) + } res, err := c.be.GetObjectAttributes(bucket, key, strings.Split(attrs, ",")) return SendXMLResponse(ctx, res, err) } + if err := c.acl.VerifyACL(bucket, access, "READ_ACP", isRoot); err != nil { + return SendResponse(ctx, err) + } + res, err := c.be.GetObject(bucket, key, acceptRange, ctx.Response().BodyWriter()) if err != nil { return SendResponse(ctx, err) @@ -131,28 +154,43 @@ func (c S3ApiController) ListActions(ctx *fiber.Ctx) error { marker := ctx.Query("continuation-token") delimiter := ctx.Query("delimiter") maxkeys := ctx.QueryInt("max-keys") + access := ctx.Locals("access").(string) + isRoot := ctx.Locals("isRoot").(bool) if ctx.Request().URI().QueryArgs().Has("acl") { + if err := c.acl.VerifyACL(bucket, access, "READ_ACP", isRoot); err != nil { + return SendXMLResponse(ctx, nil, err) + } res, err := c.be.GetBucketAcl(ctx.Params("bucket")) return SendXMLResponse(ctx, res, err) } if ctx.Request().URI().QueryArgs().Has("uploads") { + if err := c.acl.VerifyACL(bucket, access, "READ", isRoot); err != nil { + return SendXMLResponse(ctx, nil, err) + } res, err := c.be.ListMultipartUploads(&s3.ListMultipartUploadsInput{Bucket: aws.String(ctx.Params("bucket"))}) return SendXMLResponse(ctx, res, err) } if ctx.QueryInt("list-type") == 2 { + if err := c.acl.VerifyACL(bucket, access, "READ", isRoot); err != nil { + return SendXMLResponse(ctx, nil, err) + } res, err := c.be.ListObjectsV2(bucket, prefix, marker, delimiter, maxkeys) return SendXMLResponse(ctx, res, err) } + if err := c.acl.VerifyACL(bucket, access, "READ", isRoot); err != nil { + return SendXMLResponse(ctx, nil, err) + } + res, err := c.be.ListObjects(bucket, prefix, marker, delimiter, maxkeys) return SendXMLResponse(ctx, res, err) } func (c S3ApiController) PutBucketActions(ctx *fiber.Ctx) error { - bucket, acl, grantFullControl, grantRead, grantReadACP, granWrite, grantWriteACP, access := + bucket, acl, grantFullControl, grantRead, grantReadACP, granWrite, grantWriteACP, access, isRoot := ctx.Params("bucket"), ctx.Get("X-Amz-Acl"), ctx.Get("X-Amz-Grant-Full-Control"), @@ -160,15 +198,24 @@ func (c S3ApiController) PutBucketActions(ctx *fiber.Ctx) error { ctx.Get("X-Amz-Grant-Read-Acp"), ctx.Get("X-Amz-Grant-Write"), ctx.Get("X-Amz-Grant-Write-Acp"), - ctx.Locals("access") + ctx.Locals("access").(string), + ctx.Locals("isRoot").(bool) - owner := access.(string) grants := grantFullControl + grantRead + grantReadACP + granWrite + grantWriteACP if grants != "" || acl != "" { if grants != "" && acl != "" { return errors.New("wrong api call") } + + if acl != "" && acl != "private" && acl != "public-read" && acl != "public-read-write" { + return errors.New("wrong api call") + } + + if err := c.acl.VerifyACL(bucket, access, "WRITE_ACP", isRoot); err != nil { + return SendResponse(ctx, err) + } + err := c.be.PutBucketAcl(&s3.PutBucketAclInput{ Bucket: &bucket, ACL: types.BucketCannedACL(acl), @@ -177,13 +224,13 @@ func (c S3ApiController) PutBucketActions(ctx *fiber.Ctx) error { GrantReadACP: &grantReadACP, GrantWrite: &granWrite, GrantWriteACP: &grantWriteACP, - AccessControlPolicy: &types.AccessControlPolicy{Owner: &types.Owner{ID: &owner}}, + AccessControlPolicy: &types.AccessControlPolicy{Owner: &types.Owner{ID: &access}}, }) return SendResponse(ctx, err) } - err := c.be.PutBucket(bucket, owner) + err := c.be.PutBucket(bucket, access) return SendResponse(ctx, err) } @@ -193,6 +240,8 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { keyEnd := ctx.Params("*1") uploadId := ctx.Query("uploadId") partNumberStr := ctx.Query("partNumber") + access := ctx.Locals("access").(string) + isRoot := ctx.Locals("isRoot").(bool) // Copy source headers copySource := ctx.Get("X-Amz-Copy-Source") @@ -237,6 +286,10 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { return SendResponse(ctx, s3err.GetAPIError(s3err.ErrInvalidPart)) } + if err := c.acl.VerifyACL(bucket, access, "WRITE", isRoot); err != nil { + return SendResponse(ctx, err) + } + body := io.ReadSeeker(bytes.NewReader([]byte(ctx.Body()))) etag, err := c.be.PutObjectPart(bucket, keyStart, uploadId, partNumber, contentLength, body) @@ -249,6 +302,10 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { return errors.New("wrong api call") } + if err := c.acl.VerifyACL(bucket, access, "WRITE_ACP", isRoot); err != nil { + return SendResponse(ctx, err) + } + err := c.be.PutObjectAcl(&s3.PutObjectAclInput{ Bucket: &bucket, Key: &keyStart, @@ -268,12 +325,20 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { copySourceSplit := strings.Split(copySource, "/") srcBucket, srcObject := copySourceSplit[0], copySourceSplit[1:] + if err := c.acl.VerifyACL(bucket, access, "WRITE", isRoot); err != nil { + return SendXMLResponse(ctx, nil, err) + } + res, err := c.be.CopyObject(srcBucket, strings.Join(srcObject, "/"), bucket, keyStart) return SendXMLResponse(ctx, res, err) } metadata := utils.GetUserMetaData(&ctx.Request().Header) + if err := c.acl.VerifyACL(bucket, access, "WRITE", isRoot); err != nil { + return SendResponse(ctx, err) + } + etag, err := c.be.PutObject(&s3.PutObjectInput{ Bucket: &bucket, Key: &keyStart, @@ -286,17 +351,27 @@ func (c S3ApiController) PutActions(ctx *fiber.Ctx) error { } func (c S3ApiController) DeleteBucket(ctx *fiber.Ctx) error { - err := c.be.DeleteBucket(ctx.Params("bucket")) + bucket, access, isRoot := ctx.Params("bucket"), ctx.Locals("access").(string), ctx.Locals("isRoot").(bool) + if err := c.acl.VerifyACL(bucket, access, "WRITE", isRoot); err != nil { + return SendResponse(ctx, err) + } + err := c.be.DeleteBucket(bucket) return SendResponse(ctx, err) } func (c S3ApiController) DeleteObjects(ctx *fiber.Ctx) error { + bucket, access, isRoot := ctx.Params("bucket"), ctx.Locals("access").(string), ctx.Locals("isRoot").(bool) var dObj types.Delete + if err := xml.Unmarshal(ctx.Body(), &dObj); err != nil { return errors.New("wrong api call") } - err := c.be.DeleteObjects(ctx.Params("bucket"), &s3.DeleteObjectsInput{Delete: &dObj}) + if err := c.acl.VerifyACL(bucket, access, "WRITE", isRoot); err != nil { + return SendResponse(ctx, err) + } + + err := c.be.DeleteObjects(bucket, &s3.DeleteObjectsInput{Delete: &dObj}) return SendResponse(ctx, err) } @@ -305,6 +380,8 @@ func (c S3ApiController) DeleteActions(ctx *fiber.Ctx) error { key := ctx.Params("key") keyEnd := ctx.Params("*1") uploadId := ctx.Query("uploadId") + access := ctx.Locals("access").(string) + isRoot := ctx.Locals("isRoot").(bool) if keyEnd != "" { key = strings.Join([]string{key, keyEnd}, "/") @@ -313,6 +390,10 @@ func (c S3ApiController) DeleteActions(ctx *fiber.Ctx) error { if uploadId != "" { expectedBucketOwner, requestPayer := ctx.Get("X-Amz-Expected-Bucket-Owner"), ctx.Get("X-Amz-Request-Payer") + if err := c.acl.VerifyACL(bucket, access, "WRITE", isRoot); err != nil { + return SendResponse(ctx, err) + } + err := c.be.AbortMultipartUpload(&s3.AbortMultipartUploadInput{ UploadId: &uploadId, Bucket: &bucket, @@ -323,12 +404,21 @@ func (c S3ApiController) DeleteActions(ctx *fiber.Ctx) error { return SendResponse(ctx, err) } + if err := c.acl.VerifyACL(bucket, access, "WRITE", isRoot); err != nil { + return SendResponse(ctx, err) + } + err := c.be.DeleteObject(bucket, key) return SendResponse(ctx, err) } func (c S3ApiController) HeadBucket(ctx *fiber.Ctx) error { - _, err := c.be.HeadBucket(ctx.Params("bucket")) + bucket, access, isRoot := ctx.Params("bucket"), ctx.Locals("access").(string), ctx.Locals("isRoot").(bool) + if err := c.acl.VerifyACL(bucket, access, "READ", isRoot); err != nil { + return SendResponse(ctx, err) + } + + _, err := c.be.HeadBucket(bucket) // TODO: set bucket response headers return SendResponse(ctx, err) } @@ -338,13 +428,17 @@ const ( ) func (c S3ApiController) HeadObject(ctx *fiber.Ctx) error { - bucket := ctx.Params("bucket") + bucket, access, isRoot := ctx.Params("bucket"), ctx.Locals("access").(string), ctx.Locals("isRoot").(bool) key := ctx.Params("key") keyEnd := ctx.Params("*1") if keyEnd != "" { key = strings.Join([]string{key, keyEnd}, "/") } + if err := c.acl.VerifyACL(bucket, access, "READ", isRoot); err != nil { + return SendResponse(ctx, err) + } + res, err := c.be.HeadObject(bucket, key) if err != nil { return SendResponse(ctx, err) @@ -389,6 +483,8 @@ func (c S3ApiController) CreateActions(ctx *fiber.Ctx) error { key := ctx.Params("key") keyEnd := ctx.Params("*1") uploadId := ctx.Query("uploadId") + access := ctx.Locals("access").(string) + isRoot := ctx.Locals("isRoot").(bool) if keyEnd != "" { key = strings.Join([]string{key, keyEnd}, "/") @@ -400,6 +496,11 @@ func (c S3ApiController) CreateActions(ctx *fiber.Ctx) error { if xmlErr != nil { return errors.New("wrong api call") } + + if err := c.acl.VerifyACL(bucket, access, "WRITE", isRoot); err != nil { + return SendResponse(ctx, err) + } + err := c.be.RestoreObject(bucket, key, &restoreRequest) return SendResponse(ctx, err) } @@ -413,9 +514,18 @@ func (c S3ApiController) CreateActions(ctx *fiber.Ctx) error { return errors.New("wrong api call") } + if err := c.acl.VerifyACL(bucket, access, "WRITE", isRoot); err != nil { + return SendXMLResponse(ctx, nil, err) + } + res, err := c.be.CompleteMultipartUpload(bucket, key, uploadId, data.Parts) return SendXMLResponse(ctx, res, err) } + + if err := c.acl.VerifyACL(bucket, access, "WRITE", isRoot); err != nil { + return SendXMLResponse(ctx, nil, err) + } + res, err := c.be.CreateMultipartUpload(&s3.CreateMultipartUploadInput{Bucket: &bucket, Key: &key}) return SendXMLResponse(ctx, res, err) } diff --git a/s3api/controllers/base_test.go b/s3api/controllers/base_test.go index c92beadf..6931544e 100644 --- a/s3api/controllers/base_test.go +++ b/s3api/controllers/base_test.go @@ -39,6 +39,7 @@ func TestNew(t *testing.T) { } be := backend.BackendUnsupported{} + acl := auth.ACLServiceUnsupported{} tests := []struct { name string @@ -51,7 +52,8 @@ func TestNew(t *testing.T) { be: be, }, want: S3ApiController{ - be: be, + be: be, + acl: acl, }, }, } @@ -66,58 +68,80 @@ func TestNew(t *testing.T) { func TestS3ApiController_ListBuckets(t *testing.T) { type args struct { - ctx *fiber.Ctx + req *http.Request } app := fiber.New() + s3ApiController := S3ApiController{ + be: &BackendMock{ + ListBucketsFunc: func() (*s3.ListBucketsOutput, error) { + return &s3.ListBucketsOutput{}, nil + }, + }, + acl: auth.ACLServiceUnsupported{}, + } + + app.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) + app.Get("/", s3ApiController.ListBuckets) + + // Error case + appErr := fiber.New() + s3ApiControllerErr := S3ApiController{ + be: &BackendMock{ + ListBucketsFunc: func() (*s3.ListBucketsOutput, error) { + return nil, s3err.GetAPIError(s3err.ErrMethodNotAllowed) + }, + }, + acl: auth.ACLServiceUnsupported{}, + } + + appErr.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) + appErr.Get("/", s3ApiControllerErr.ListBuckets) tests := []struct { name string - c S3ApiController args args + app *fiber.App wantErr bool statusCode int }{ { - name: "List-bucket-not-implemented", - c: S3ApiController{ - be: backend.BackendUnsupported{}, - }, + name: "List-bucket-method-not-allowed", args: args{ - ctx: app.AcquireCtx(&fasthttp.RequestCtx{}), + req: httptest.NewRequest(http.MethodGet, "/", nil), }, + app: appErr, wantErr: false, - statusCode: 501, + statusCode: 405, }, { name: "list-bucket-success", - c: S3ApiController{ - be: &BackendMock{ - ListBucketsFunc: func() (*s3.ListBucketsOutput, error) { - return &s3.ListBucketsOutput{}, nil - }, - }, - }, args: args{ - ctx: app.AcquireCtx(&fasthttp.RequestCtx{}), + req: httptest.NewRequest(http.MethodGet, "/", nil), }, + app: app, wantErr: false, statusCode: 200, }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - err := tt.c.ListBuckets(tt.args.ctx) + resp, err := tt.app.Test(tt.args.req) if (err != nil) != tt.wantErr { t.Errorf("S3ApiController.ListBuckets() error = %v, wantErr %v", err, tt.wantErr) - return } - statusCode := tt.args.ctx.Response().StatusCode() - - if statusCode != tt.statusCode { - t.Errorf("S3ApiController.ListBuckets() code = %v, wantErr %v", statusCode, tt.wantErr) + if resp.StatusCode != tt.statusCode { + t.Errorf("S3ApiController.ListBuckets() statusCode = %v, wantStatusCode = %v", resp.StatusCode, tt.statusCode) } }) } @@ -129,20 +153,28 @@ func TestS3ApiController_GetActions(t *testing.T) { } app := fiber.New() - s3ApiController := S3ApiController{be: &BackendMock{ - ListObjectPartsFunc: func(bucket, object, uploadID string, partNumberMarker int, maxParts int) (s3response.ListPartsResponse, error) { - return s3response.ListPartsResponse{}, nil + s3ApiController := S3ApiController{ + be: &BackendMock{ + ListObjectPartsFunc: func(bucket, object, uploadID string, partNumberMarker int, maxParts int) (s3response.ListPartsResponse, error) { + return s3response.ListPartsResponse{}, nil + }, + GetObjectAclFunc: func(bucket, object string) (*s3.GetObjectAclOutput, error) { + return &s3.GetObjectAclOutput{}, nil + }, + GetObjectAttributesFunc: func(bucket, object string, attributes []string) (*s3.GetObjectAttributesOutput, error) { + return &s3.GetObjectAttributesOutput{}, nil + }, + GetObjectFunc: func(bucket, object, acceptRange string, writer io.Writer) (*s3.GetObjectOutput, error) { + return &s3.GetObjectOutput{Metadata: nil}, nil + }, }, - GetObjectAclFunc: func(bucket, object string) (*s3.GetObjectAclOutput, error) { - return &s3.GetObjectAclOutput{}, nil - }, - GetObjectAttributesFunc: func(bucket, object string, attributes []string) (*s3.GetObjectAttributesOutput, error) { - return &s3.GetObjectAttributesOutput{}, nil - }, - GetObjectFunc: func(bucket, object, acceptRange string, writer io.Writer) (*s3.GetObjectOutput, error) { - return &s3.GetObjectOutput{Metadata: nil}, nil - }, - }} + acl: &auth.ACLServiceUnsupported{}, + } + app.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) app.Get("/:bucket/:key/*", s3ApiController.GetActions) // GetObjectACL @@ -231,29 +263,47 @@ func TestS3ApiController_ListActions(t *testing.T) { } app := fiber.New() - s3ApiController := S3ApiController{be: &BackendMock{ - GetBucketAclFunc: func(bucket string) (*auth.GetBucketAclOutput, error) { - return nil, nil + s3ApiController := S3ApiController{ + be: &BackendMock{ + GetBucketAclFunc: func(bucket string) (*auth.GetBucketAclOutput, error) { + return nil, nil + }, + ListMultipartUploadsFunc: func(output *s3.ListMultipartUploadsInput) (s3response.ListMultipartUploadsResponse, error) { + return s3response.ListMultipartUploadsResponse{}, nil + }, + ListObjectsV2Func: func(bucket, prefix, marker, delim string, maxkeys int) (*s3.ListObjectsV2Output, error) { + return &s3.ListObjectsV2Output{}, nil + }, + ListObjectsFunc: func(bucket, prefix, marker, delim string, maxkeys int) (*s3.ListObjectsOutput, error) { + return &s3.ListObjectsOutput{}, nil + }, }, - ListMultipartUploadsFunc: func(output *s3.ListMultipartUploadsInput) (s3response.ListMultipartUploadsResponse, error) { - return s3response.ListMultipartUploadsResponse{}, nil - }, - ListObjectsV2Func: func(bucket, prefix, marker, delim string, maxkeys int) (*s3.ListObjectsV2Output, error) { - return &s3.ListObjectsV2Output{}, nil - }, - ListObjectsFunc: func(bucket, prefix, marker, delim string, maxkeys int) (*s3.ListObjectsOutput, error) { - return &s3.ListObjectsOutput{}, nil - }, - }} + acl: auth.ACLServiceUnsupported{}, + } + + app.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) + app.Get("/:bucket", s3ApiController.ListActions) //Error case - s3ApiControllerError := S3ApiController{be: &BackendMock{ - ListObjectsFunc: func(bucket, prefix, marker, delim string, maxkeys int) (*s3.ListObjectsOutput, error) { - return nil, s3err.GetAPIError(s3err.ErrNotImplemented) + s3ApiControllerError := S3ApiController{ + be: &BackendMock{ + ListObjectsFunc: func(bucket, prefix, marker, delim string, maxkeys int) (*s3.ListObjectsOutput, error) { + return nil, s3err.GetAPIError(s3err.ErrNotImplemented) + }, }, - }} + acl: auth.ACLServiceUnsupported{}, + } appError := fiber.New() + appError.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) appError.Get("/:bucket", s3ApiControllerError.ListActions) tests := []struct { @@ -330,17 +380,21 @@ func TestS3ApiController_PutBucketActions(t *testing.T) { } app := fiber.New() - s3ApiController := S3ApiController{be: &BackendMock{ - PutBucketAclFunc: func(*s3.PutBucketAclInput) error { - return nil + s3ApiController := S3ApiController{ + be: &BackendMock{ + PutBucketAclFunc: func(*s3.PutBucketAclInput) error { + return nil + }, + PutBucketFunc: func(bucket, owner string) error { + return nil + }, }, - PutBucketFunc: func(bucket, owner string) error { - return nil - }, - }} + acl: auth.ACLServiceUnsupported{}, + } // Mock ctx.Locals app.Use(func(ctx *fiber.Ctx) error { ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) return ctx.Next() }) app.Put("/:bucket", s3ApiController.PutBucketActions) @@ -408,20 +462,28 @@ func TestS3ApiController_PutActions(t *testing.T) { } app := fiber.New() - s3ApiController := S3ApiController{be: &BackendMock{ - UploadPartCopyFunc: func(*s3.UploadPartCopyInput) (*s3.UploadPartCopyOutput, error) { - return &s3.UploadPartCopyOutput{}, nil + s3ApiController := S3ApiController{ + be: &BackendMock{ + UploadPartCopyFunc: func(*s3.UploadPartCopyInput) (*s3.UploadPartCopyOutput, error) { + return &s3.UploadPartCopyOutput{}, nil + }, + PutObjectAclFunc: func(*s3.PutObjectAclInput) error { + return nil + }, + CopyObjectFunc: func(srcBucket, srcObject, DstBucket, dstObject string) (*s3.CopyObjectOutput, error) { + return &s3.CopyObjectOutput{}, nil + }, + PutObjectFunc: func(*s3.PutObjectInput) (string, error) { + return "Hey", nil + }, }, - PutObjectAclFunc: func(*s3.PutObjectAclInput) error { - return nil - }, - CopyObjectFunc: func(srcBucket, srcObject, DstBucket, dstObject string) (*s3.CopyObjectOutput, error) { - return &s3.CopyObjectOutput{}, nil - }, - PutObjectFunc: func(*s3.PutObjectInput) (string, error) { - return "Hey", nil - }, - }} + acl: auth.ACLServiceUnsupported{}, + } + app.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) app.Put("/:bucket/:key/*", s3ApiController.PutActions) //PutObjectAcl error @@ -538,23 +600,40 @@ func TestS3ApiController_DeleteBucket(t *testing.T) { } app := fiber.New() - s3ApiController := S3ApiController{be: &BackendMock{ - DeleteBucketFunc: func(bucket string) error { - return nil + s3ApiController := S3ApiController{ + be: &BackendMock{ + DeleteBucketFunc: func(bucket string) error { + return nil + }, }, - }} + acl: auth.ACLServiceUnsupported{}, + } + + app.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) app.Delete("/:bucket", s3ApiController.DeleteBucket) // error case appErr := fiber.New() - s3ApiControllerErr := S3ApiController{be: &BackendMock{ - DeleteBucketFunc: func(bucket string) error { - return s3err.GetAPIError(48) + s3ApiControllerErr := S3ApiController{ + be: &BackendMock{ + DeleteBucketFunc: func(bucket string) error { + return s3err.GetAPIError(48) + }, }, - }} + acl: auth.ACLServiceUnsupported{}, + } + appErr.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) appErr.Delete("/:bucket", s3ApiControllerErr.DeleteBucket) tests := []struct { @@ -602,12 +681,20 @@ func TestS3ApiController_DeleteObjects(t *testing.T) { } app := fiber.New() - s3ApiController := S3ApiController{be: &BackendMock{ - DeleteObjectsFunc: func(bucket string, objects *s3.DeleteObjectsInput) error { - return nil + s3ApiController := S3ApiController{ + be: &BackendMock{ + DeleteObjectsFunc: func(bucket string, objects *s3.DeleteObjectsInput) error { + return nil + }, }, - }} + acl: auth.ACLServiceUnsupported{}, + } + app.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) app.Post("/:bucket", s3ApiController.DeleteObjects) // Valid request body @@ -661,15 +748,23 @@ func TestS3ApiController_DeleteActions(t *testing.T) { } app := fiber.New() - s3ApiController := S3ApiController{be: &BackendMock{ - DeleteObjectFunc: func(bucket, object string) error { - return nil + s3ApiController := S3ApiController{ + be: &BackendMock{ + DeleteObjectFunc: func(bucket, object string) error { + return nil + }, + AbortMultipartUploadFunc: func(*s3.AbortMultipartUploadInput) error { + return nil + }, }, - AbortMultipartUploadFunc: func(*s3.AbortMultipartUploadInput) error { - return nil - }, - }} + acl: auth.ACLServiceUnsupported{}, + } + app.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) app.Delete("/:bucket/:key/*", s3ApiController.DeleteActions) //Error case @@ -681,6 +776,11 @@ func TestS3ApiController_DeleteActions(t *testing.T) { }, }} + appErr.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) appErr.Delete("/:bucket", s3ApiControllerErr.DeleteBucket) tests := []struct { @@ -737,22 +837,39 @@ func TestS3ApiController_HeadBucket(t *testing.T) { } app := fiber.New() - s3ApiController := S3ApiController{be: &BackendMock{ - HeadBucketFunc: func(bucket string) (*s3.HeadBucketOutput, error) { - return &s3.HeadBucketOutput{}, nil + s3ApiController := S3ApiController{ + be: &BackendMock{ + HeadBucketFunc: func(bucket string) (*s3.HeadBucketOutput, error) { + return &s3.HeadBucketOutput{}, nil + }, }, - }} + acl: auth.ACLServiceUnsupported{}, + } + + app.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) app.Head("/:bucket", s3ApiController.HeadBucket) - //Error case + // Error case appErr := fiber.New() s3ApiControllerErr := S3ApiController{be: &BackendMock{ HeadBucketFunc: func(bucket string) (*s3.HeadBucketOutput, error) { return nil, s3err.GetAPIError(3) }, - }} + }, + acl: auth.ACLServiceUnsupported{}, + } + + appErr.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) appErr.Head("/:bucket", s3ApiControllerErr.HeadBucket) @@ -808,29 +925,45 @@ func TestS3ApiController_HeadObject(t *testing.T) { eTag := "Valid etag" lastModifie := time.Now() - s3ApiController := S3ApiController{be: &BackendMock{ - HeadObjectFunc: func(bucket, object string) (*s3.HeadObjectOutput, error) { - return &s3.HeadObjectOutput{ - ContentEncoding: &contentEncoding, - ContentLength: 64, - ContentType: &contentType, - LastModified: &lastModifie, - ETag: &eTag, - }, nil + s3ApiController := S3ApiController{ + be: &BackendMock{ + HeadObjectFunc: func(bucket, object string) (*s3.HeadObjectOutput, error) { + return &s3.HeadObjectOutput{ + ContentEncoding: &contentEncoding, + ContentLength: 64, + ContentType: &contentType, + LastModified: &lastModifie, + ETag: &eTag, + }, nil + }, }, - }} + acl: auth.ACLServiceUnsupported{}, + } + app.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) app.Head("/:bucket/:key/*", s3ApiController.HeadObject) //Error case appErr := fiber.New() - s3ApiControllerErr := S3ApiController{be: &BackendMock{ - HeadObjectFunc: func(bucket, object string) (*s3.HeadObjectOutput, error) { - return nil, s3err.GetAPIError(42) + s3ApiControllerErr := S3ApiController{ + be: &BackendMock{ + HeadObjectFunc: func(bucket, object string) (*s3.HeadObjectOutput, error) { + return nil, s3err.GetAPIError(42) + }, }, - }} + acl: auth.ACLServiceUnsupported{}, + } + appErr.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) appErr.Head("/:bucket/:key/*", s3ApiControllerErr.HeadObject) tests := []struct { @@ -877,18 +1010,26 @@ func TestS3ApiController_CreateActions(t *testing.T) { req *http.Request } app := fiber.New() - s3ApiController := S3ApiController{be: &BackendMock{ - RestoreObjectFunc: func(bucket, object string, restoreRequest *s3.RestoreObjectInput) error { - return nil + s3ApiController := S3ApiController{ + be: &BackendMock{ + RestoreObjectFunc: func(bucket, object string, restoreRequest *s3.RestoreObjectInput) error { + return nil + }, + CompleteMultipartUploadFunc: func(bucket, object, uploadID string, parts []types.Part) (*s3.CompleteMultipartUploadOutput, error) { + return &s3.CompleteMultipartUploadOutput{}, nil + }, + CreateMultipartUploadFunc: func(*s3.CreateMultipartUploadInput) (*s3.CreateMultipartUploadOutput, error) { + return &s3.CreateMultipartUploadOutput{}, nil + }, }, - CompleteMultipartUploadFunc: func(bucket, object, uploadID string, parts []types.Part) (*s3.CompleteMultipartUploadOutput, error) { - return &s3.CompleteMultipartUploadOutput{}, nil - }, - CreateMultipartUploadFunc: func(*s3.CreateMultipartUploadInput) (*s3.CreateMultipartUploadOutput, error) { - return &s3.CreateMultipartUploadOutput{}, nil - }, - }} + acl: auth.ACLServiceUnsupported{}, + } + app.Use(func(ctx *fiber.Ctx) error { + ctx.Locals("access", "valid access") + ctx.Locals("isRoot", true) + return ctx.Next() + }) app.Post("/:bucket/:key/*", s3ApiController.CreateActions) tests := []struct { diff --git a/s3api/middlewares/authentication.go b/s3api/middlewares/authentication.go index c3faeee2..88589226 100644 --- a/s3api/middlewares/authentication.go +++ b/s3api/middlewares/authentication.go @@ -136,6 +136,7 @@ func VerifyV4Signature(root RootUserConfig, iam auth.IAMService, debug bool) fib ctx.Locals("role", account.Role) ctx.Locals("access", creds[0]) + ctx.Locals("isRoot", creds[0] == root.Access) return ctx.Next() }