Improvement/cldsrv 427 permissions checks #5432

benzekrimaha · 2023-11-13T13:24:07Z

PR opened after closing : #5323 and #5421
Bucket policies are not correctly interpreted, this is part of the following epic to fix that: scality/Arsenal#2181

This PR is aiming enable authorization logics from IAM policies, bucket policies and ACLs to be interpreted in aggregate in CloudServer's 'isBucketAuthorized' and 'isObjectAuthorized' functions. , ticket linked to this issue here : https://scality.atlassian.net/browse/CLDSRV-427

PRs providing implicit Deny logic to CS for processing in this PR
scality/Arsenal#2181
https://github.com/scality/Vault/pull/2135
#5322
#5420

I'm not bumping a new CLDSRV version since a new version has been created in this merged PR : #5322 , Please let me know if it needs to be done anyways.

nicolas2bert · 2023-11-13T15:53:45Z

I did not mean to approve this draft PR.

bert-e · 2023-11-13T16:28:03Z

Hello benzekrimaha,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Status report is not available.

bert-e · 2023-11-13T16:28:10Z

Incorrect fix version

The Fix Version/s in issue CLDSRV-427 contains:

7.70.30

Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:

7.10.33
7.70.30
8.6.12
8.7.31
8.8.5

Please check the Fix Version/s of CLDSRV-427, or the target
branch of this pull request.

bert-e · 2023-11-13T23:05:57Z

Incorrect fix version

The Fix Version/s in issue CLDSRV-427 contains:

7.70.30

Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:

7.10.33
7.70.31
8.6.13
8.7.31
8.8.5

Please check the Fix Version/s of CLDSRV-427, or the target
branch of this pull request.

benzekrimaha · 2023-11-14T07:31:47Z

ping

bert-e · 2023-11-14T07:31:58Z

Request integration branches

Waiting for integration branch creation to be requested by the user.

To request integration branches, please comment on this pull request with the following command:

/create_integration_branches

Alternatively, the /approve and /create_pull_requests commands will automatically
create the integration branches.

benzekrimaha · 2023-11-14T07:32:10Z

/create_integration_branches

bert-e · 2023-11-14T07:32:23Z

Conflict

A conflict has been raised during the creation of
integration branch w/7.70/improvement/CLDSRV-427-permissions-checks with contents from improvement/CLDSRV-427-permissions-checks
and development/7.70.

I have not created the integration branch.

Here are the steps to resolve this conflict:

 $ git fetch
 $ git checkout -B w/7.70/improvement/CLDSRV-427-permissions-checks origin/development/7.70
 $ git merge origin/improvement/CLDSRV-427-permissions-checks
 $ # <intense conflict resolution>
 $ git commit
 $ git push -u origin w/7.70/improvement/CLDSRV-427-permissions-checks

The following options are set: create_integration_branches

bert-e · 2023-11-15T10:23:52Z

Conflict

A conflict has been raised during the creation of
integration branch w/8.6/improvement/CLDSRV-427-permissions-checks with contents from w/7.70/improvement/CLDSRV-427-permissions-checks
and development/8.6.

I have not created the integration branch.

Here are the steps to resolve this conflict:

 $ git fetch
 $ git checkout -B w/8.6/improvement/CLDSRV-427-permissions-checks origin/development/8.6
 $ git merge origin/w/7.70/improvement/CLDSRV-427-permissions-checks
 $ # <intense conflict resolution>
 $ git commit
 $ git push -u origin w/8.6/improvement/CLDSRV-427-permissions-checks

The following options are set: create_integration_branches

…denies (cherry picked from commit c01898f) (cherry picked from commit 7aa326c)

(cherry picked from commit a7396a7)

bert-e · 2023-11-15T10:29:46Z

History mismatch

Merge commit #48b09afb4ba6309c9064afc7fbe9396f802a39c2 on the integration branch
w/7.70/improvement/CLDSRV-427-permissions-checks is merging a branch which is neither the current
branch improvement/CLDSRV-427-permissions-checks nor the development branch
development/7.70.

It is likely due to a rebase of the branch improvement/CLDSRV-427-permissions-checks and the
merge is not possible until all related w/* branches are deleted or updated.

Please use the reset command to have me reinitialize these branches.

The following options are set: create_integration_branches

benzekrimaha · 2023-11-15T10:32:00Z

/reset

bert-e · 2023-11-15T10:32:08Z

Reset complete

I have successfully deleted this pull request's integration branches.

The following options are set: create_integration_branches

bert-e · 2023-11-15T10:32:19Z

Conflict

A conflict has been raised during the creation of
integration branch w/8.6/improvement/CLDSRV-427-permissions-checks with contents from w/7.70/improvement/CLDSRV-427-permissions-checks
and development/8.6.

I have not created the integration branch.

Here are the steps to resolve this conflict:

 $ git fetch
 $ git checkout -B w/8.6/improvement/CLDSRV-427-permissions-checks origin/development/8.6
 $ git merge origin/w/7.70/improvement/CLDSRV-427-permissions-checks
 $ # <intense conflict resolution>
 $ git commit
 $ git push -u origin w/8.6/improvement/CLDSRV-427-permissions-checks

The following options are set: create_integration_branches

benzekrimaha · 2023-11-15T10:46:40Z

ping

bert-e · 2023-11-15T10:46:52Z

Integration data created

I have created the integration data for the additional destination branches.

this pull request will merge improvement/CLDSRV-427-permissions-checks into
development/7.10
w/7.70/improvement/CLDSRV-427-permissions-checks will be merged into development/7.70
w/8.6/improvement/CLDSRV-427-permissions-checks will be merged into development/8.6
w/8.7/improvement/CLDSRV-427-permissions-checks will be merged into development/8.7
w/8.8/improvement/CLDSRV-427-permissions-checks will be merged into development/8.8

The following branches will NOT be impacted:

development/7.4

You can set option create_pull_requests if you need me to create
integration pull requests in addition to integration branches, with:

@bert-e create_pull_requests

The following options are set: create_integration_branches

bert-e · 2023-11-15T10:46:53Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_integration_branches

lib/api/apiUtils/authorization/permissionChecks.js

bert-e · 2023-11-15T11:05:16Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following reviewers are expecting changes from the author, or must review again:

@anurag4DSB

The following options are set: create_integration_branches

lib/api/apiUtils/authorization/permissionChecks.js

- In this commit , I added a helper (processBucketPolicy) function for the bycket policies checks that are shared between the isbucketAuthorized, isObjAuthorized and evaluateBucketPolicyWithIAM for a better code readability and to avoid long functions. (cherry picked from commit 33d7c99)

bert-e · 2023-11-17T10:36:50Z

History mismatch

Merge commit #6e240c31b9231fb52bfbcc3bdaadc8d86dda135b on the integration branch
w/7.70/improvement/CLDSRV-427-permissions-checks is merging a branch which is neither the current
branch improvement/CLDSRV-427-permissions-checks nor the development branch
development/7.70.

It is likely due to a rebase of the branch improvement/CLDSRV-427-permissions-checks and the
merge is not possible until all related w/* branches are deleted or updated.

Please use the reset command to have me reinitialize these branches.

The following options are set: create_integration_branches

…ns-checks

benzekrimaha · 2023-11-17T10:50:31Z

/reset

bert-e · 2023-11-17T10:50:41Z

Reset complete

I have successfully deleted this pull request's integration branches.

The following options are set: create_integration_branches

bert-e · 2023-11-17T10:50:54Z

Conflict

A conflict has been raised during the creation of
integration branch w/8.6/improvement/CLDSRV-427-permissions-checks with contents from w/7.70/improvement/CLDSRV-427-permissions-checks
and development/8.6.

I have not created the integration branch.

Here are the steps to resolve this conflict:

 $ git fetch
 $ git checkout -B w/8.6/improvement/CLDSRV-427-permissions-checks origin/development/8.6
 $ git merge origin/w/7.70/improvement/CLDSRV-427-permissions-checks
 $ # <intense conflict resolution>
 $ git commit
 $ git push -u origin w/8.6/improvement/CLDSRV-427-permissions-checks

The following options are set: create_integration_branches

bert-e · 2023-11-17T11:30:09Z

Integration data created

I have created the integration data for the additional destination branches.

this pull request will merge improvement/CLDSRV-427-permissions-checks into
development/7.10
w/7.70/improvement/CLDSRV-427-permissions-checks will be merged into development/7.70
w/8.6/improvement/CLDSRV-427-permissions-checks will be merged into development/8.6
w/8.7/improvement/CLDSRV-427-permissions-checks will be merged into development/8.7
w/8.8/improvement/CLDSRV-427-permissions-checks will be merged into development/8.8

The following branches will NOT be impacted:

development/7.4

You can set option create_pull_requests if you need me to create
integration pull requests in addition to integration branches, with:

@bert-e create_pull_requests

The following options are set: create_integration_branches

bert-e · 2023-11-17T11:30:10Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_integration_branches

benzekrimaha · 2023-11-17T12:09:25Z

@bert-e create_pull_requests

bert-e · 2023-11-17T12:09:44Z

Integration data created

I have created the integration data for the additional destination branches.

this pull request will merge improvement/CLDSRV-427-permissions-checks into
development/7.10
w/7.70/improvement/CLDSRV-427-permissions-checks will be merged into development/7.70 (pull request INTEGRATION [PR#5432 > development/7.70] Improvement/cldsrv 427 permissions checks #5445)
w/8.6/improvement/CLDSRV-427-permissions-checks will be merged into development/8.6 (pull request INTEGRATION [PR#5432 > development/8.6] Improvement/cldsrv 427 permissions checks #5446)
w/8.7/improvement/CLDSRV-427-permissions-checks will be merged into development/8.7 (pull request INTEGRATION [PR#5432 > development/8.7] Improvement/cldsrv 427 permissions checks #5447)
w/8.8/improvement/CLDSRV-427-permissions-checks will be merged into development/8.8 (pull request INTEGRATION [PR#5432 > development/8.8] Improvement/cldsrv 427 permissions checks #5448)

The following branches will NOT be impacted:

development/7.4

Follow integration pull requests if you would like to be notified of
build statuses by email.

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2023-11-17T12:09:46Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_pull_requests, create_integration_branches

benzekrimaha · 2023-11-17T12:10:07Z

/approve

bert-e · 2023-11-17T12:10:33Z

In the queue

The changeset has received all authorizations and has been added to the
relevant queue(s). The queue(s) will be merged in the target development
branch(es) as soon as builds have passed.

The changeset will be merged in:

✔️ development/7.10
✔️ development/7.70
✔️ development/8.6
✔️ development/8.7
✔️ development/8.8

The following branches will NOT be impacted:

development/7.4

There is no action required on your side. You will be notified here once
the changeset has been merged. In the unlikely event that the changeset
fails permanently on the queue, a member of the admin team will
contact you to help resolve the matter.

IMPORTANT

Please do not attempt to modify this pull request.

Any commit you add on the source branch will trigger a new cycle after the
current queue is merged.
Any commit you add on one of the integration branches will be lost.

If you need this pull request to be removed from the queue, please contact a
member of the admin team now.

The following options are set: approve, create_pull_requests, create_integration_branches

bert-e · 2023-11-17T12:10:49Z

I have successfully merged the changeset of this pull request
into targetted development branches:

✔️ development/7.10
✔️ development/7.70
✔️ development/8.6
✔️ development/8.7
✔️ development/8.8

The following branches have NOT changed:

development/7.4

Please check the status of the associated issue CLDSRV-427.

Goodbye benzekrimaha.

benzekrimaha mentioned this pull request Nov 13, 2023

Improvement/cldsrv-426-ACL-Implicit-Deny #5420

Merged

benzekrimaha requested review from KazToozs, anurag4DSB and Kerkesni November 13, 2023 15:34

nicolas2bert approved these changes Nov 13, 2023

View reviewed changes

Base automatically changed from improvement/CLDSRV-426-acl-impl-deny to development/7.10 November 13, 2023 16:27

benzekrimaha force-pushed the improvement/CLDSRV-427-permissions-checks branch from 4d63d3d to 653e213 Compare November 15, 2023 10:23

Will Toozs and others added 2 commits November 15, 2023 11:26

CLDSRV-427: update bucket/object perm checks to account for implicit …

0e323fb

…denies (cherry picked from commit c01898f) (cherry picked from commit 7aa326c)

CLDSRV-427: linting fixups and retrocompatibility changes

fa2f877

(cherry picked from commit a7396a7)

benzekrimaha force-pushed the improvement/CLDSRV-427-permissions-checks branch from 653e213 to 6e240c3 Compare November 15, 2023 10:29

benzekrimaha marked this pull request as ready for review November 15, 2023 10:48

anurag4DSB requested changes Nov 15, 2023

View reviewed changes

KillianG reviewed Nov 15, 2023

View reviewed changes

lib/api/apiUtils/authorization/permissionChecks.js Outdated Show resolved Hide resolved

benzekrimaha force-pushed the improvement/CLDSRV-427-permissions-checks branch from 1fb1b84 to 6caa5cc Compare November 17, 2023 10:36

Merge branch 'development/7.10' into improvement/CLDSRV-427-permissio…

693ddf8

…ns-checks

KillianG approved these changes Nov 17, 2023

View reviewed changes

bert-e mentioned this pull request Nov 17, 2023

INTEGRATION [PR#5432 > development/8.8] Improvement/cldsrv 427 permissions checks #5448

Merged

bert-e merged commit 693ddf8 into development/7.10 Nov 17, 2023
14 checks passed

bert-e deleted the improvement/CLDSRV-427-permissions-checks branch November 17, 2023 12:11

This was referenced Nov 17, 2023

Improvement/cldsrv 428 put apis implicit deny #5449

Closed

Improvement/cldsrv 428 put apis implicit deny #5450

Closed

This was referenced Nov 27, 2023

CLDSRV-428: put apis updated for implicit deny #5456

Merged

CLDSRV-429: update get apis with impDeny logic #5461

Closed

CLDSRV-429: update get apis with impDeny logic #5462

Merged

benzekrimaha mentioned this pull request Dec 5, 2023

Improvement/cldsrv 430 delete api implicit deny #5470

Merged

This was referenced Dec 14, 2023

Improvement/cldsrv 431 misc api implicit deny #5479

Merged

improvement/CLDSRV-451-specific-7.70-apis-update #5495

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improvement/cldsrv 427 permissions checks #5432

Improvement/cldsrv 427 permissions checks #5432

benzekrimaha commented Nov 13, 2023

nicolas2bert commented Nov 13, 2023

bert-e commented Nov 13, 2023

bert-e commented Nov 13, 2023

bert-e commented Nov 13, 2023

benzekrimaha commented Nov 14, 2023

bert-e commented Nov 14, 2023

benzekrimaha commented Nov 14, 2023

bert-e commented Nov 14, 2023

bert-e commented Nov 15, 2023

bert-e commented Nov 15, 2023

benzekrimaha commented Nov 15, 2023

bert-e commented Nov 15, 2023

bert-e commented Nov 15, 2023

benzekrimaha commented Nov 15, 2023

bert-e commented Nov 15, 2023

bert-e commented Nov 15, 2023

bert-e commented Nov 15, 2023

bert-e commented Nov 17, 2023

benzekrimaha commented Nov 17, 2023

bert-e commented Nov 17, 2023

bert-e commented Nov 17, 2023

bert-e commented Nov 17, 2023

bert-e commented Nov 17, 2023

benzekrimaha commented Nov 17, 2023

bert-e commented Nov 17, 2023

bert-e commented Nov 17, 2023

benzekrimaha commented Nov 17, 2023

bert-e commented Nov 17, 2023

bert-e commented Nov 17, 2023

Improvement/cldsrv 427 permissions checks #5432

Improvement/cldsrv 427 permissions checks #5432

Conversation

benzekrimaha commented Nov 13, 2023

nicolas2bert commented Nov 13, 2023

bert-e commented Nov 13, 2023

Hello benzekrimaha,

bert-e commented Nov 13, 2023

Incorrect fix version

bert-e commented Nov 13, 2023

Incorrect fix version

benzekrimaha commented Nov 14, 2023

bert-e commented Nov 14, 2023

Request integration branches

benzekrimaha commented Nov 14, 2023

bert-e commented Nov 14, 2023

Conflict

bert-e commented Nov 15, 2023

Conflict

bert-e commented Nov 15, 2023

History mismatch

benzekrimaha commented Nov 15, 2023

bert-e commented Nov 15, 2023

Reset complete

bert-e commented Nov 15, 2023

Conflict

benzekrimaha commented Nov 15, 2023

bert-e commented Nov 15, 2023

Integration data created

bert-e commented Nov 15, 2023

Waiting for approval

bert-e commented Nov 15, 2023

Waiting for approval

bert-e commented Nov 17, 2023

History mismatch

benzekrimaha commented Nov 17, 2023

bert-e commented Nov 17, 2023

Reset complete

bert-e commented Nov 17, 2023

Conflict

bert-e commented Nov 17, 2023

Integration data created

bert-e commented Nov 17, 2023

Waiting for approval

benzekrimaha commented Nov 17, 2023

bert-e commented Nov 17, 2023

Integration data created

bert-e commented Nov 17, 2023

Waiting for approval

benzekrimaha commented Nov 17, 2023

bert-e commented Nov 17, 2023

In the queue

bert-e commented Nov 17, 2023