CLDSRV-428: put apis updated for implicit deny #5456

benzekrimaha · 2023-11-27T14:08:31Z

PR opened after closing : #5325 and #5450

Bucket policies are not correctly interpreted, this is part of the following epic to fix that: scality/Arsenal#2181

This PR is aiming to update put apis since object and bucket authorisations are made at API level and need to support implicit denies, ticket linked to this issue here : https://scality.atlassian.net/browse/CLDSRV-428

PRs providing implicit Deny logic to CS for processing in this PR
scality/Arsenal#2181
https://github.com/scality/Vault/pull/2135
#5322
#5420
#5432

Here CI links for zenko tests :
https://github.com/scality/Zenko/actions/runs/7008162132
https://github.com/scality/Zenko/actions/runs/7008182601
https://github.com/scality/Zenko/actions/runs/7008194429

I'll be bumping a new CLDSRV once the reviews done as these are changes that will be tested against Integration

bert-e · 2023-11-27T14:08:36Z

Hello benzekrimaha,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Status report is not available.

bert-e · 2023-11-27T14:08:43Z

Request integration branches

Waiting for integration branch creation to be requested by the user.

To request integration branches, please comment on this pull request with the following command:

/create_integration_branches

Alternatively, the /approve and /create_pull_requests commands will automatically
create the integration branches.

benzekrimaha · 2023-11-27T14:16:20Z

/create_integration_branches

bert-e · 2023-11-27T14:16:30Z

Conflict

A conflict has been raised during the creation of
integration branch w/7.70/improvement/CLDSRV-428-put-apis-impDeny with contents from improvement/CLDSRV-428-put-apis-impDeny
and development/7.70.

I have not created the integration branch.

Here are the steps to resolve this conflict:

 $ git fetch
 $ git checkout -B w/7.70/improvement/CLDSRV-428-put-apis-impDeny origin/development/7.70
 $ git merge origin/improvement/CLDSRV-428-put-apis-impDeny
 $ # <intense conflict resolution>
 $ git commit
 $ git push -u origin w/7.70/improvement/CLDSRV-428-put-apis-impDeny

The following options are set: create_integration_branches

benzekrimaha · 2023-11-27T15:09:25Z

ping

bert-e · 2023-11-27T15:09:37Z

Conflict

A conflict has been raised during the creation of
integration branch w/8.6/improvement/CLDSRV-428-put-apis-impDeny with contents from w/7.70/improvement/CLDSRV-428-put-apis-impDeny
and development/8.6.

I have not created the integration branch.

Here are the steps to resolve this conflict:

 $ git fetch
 $ git checkout -B w/8.6/improvement/CLDSRV-428-put-apis-impDeny origin/development/8.6
 $ git merge origin/w/7.70/improvement/CLDSRV-428-put-apis-impDeny
 $ # <intense conflict resolution>
 $ git commit
 $ git push -u origin w/8.6/improvement/CLDSRV-428-put-apis-impDeny

The following options are set: create_integration_branches

benzekrimaha · 2023-11-27T15:14:03Z

ping

bert-e · 2023-11-27T15:14:16Z

Integration data created

I have created the integration data for the additional destination branches.

this pull request will merge improvement/CLDSRV-428-put-apis-impDeny into
development/7.10
w/7.70/improvement/CLDSRV-428-put-apis-impDeny will be merged into development/7.70
w/8.6/improvement/CLDSRV-428-put-apis-impDeny will be merged into development/8.6
w/8.7/improvement/CLDSRV-428-put-apis-impDeny will be merged into development/8.7
w/8.8/improvement/CLDSRV-428-put-apis-impDeny will be merged into development/8.8

The following branches will NOT be impacted:

development/7.4

You can set option create_pull_requests if you need me to create
integration pull requests in addition to integration branches, with:

@bert-e create_pull_requests

The following options are set: create_integration_branches

bert-e · 2023-11-27T15:14:19Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_integration_branches

benzekrimaha · 2023-11-27T15:19:11Z

/reset

bert-e · 2023-11-27T15:19:20Z

Reset complete

I have successfully deleted this pull request's integration branches.

The following options are set: create_integration_branches

In this commit put apis have been updated to check for implicit deny returned by vault and added as a parameter in the request Object. Tests have also been added for the metadataUtils validateBucket function. MetadataUtils functions have been updated to check for implicit deny. The goal is to implement the same authorization logic as AWS, where an implicit deny from IAM and an Allow from the Bucket Policy should allow the request for example. For the delete on the objectPutCopyPart and objectPutPart as we need to deferentiate between the vault request and the external backend once a delete is applied to the request directly as it's unique per API call this value is then added to the request object. here's the link to the design doc for more details: https://github.com/scality/citadel/blob/development/1.0/docs/design/bucket-policies.md?plain=1#L263

benzekrimaha · 2023-11-27T15:51:42Z

ping

bert-e · 2023-11-27T15:51:44Z

Conflict

A conflict has been raised during the creation of
integration branch w/7.70/improvement/CLDSRV-428-put-apis-impDeny with contents from improvement/CLDSRV-428-put-apis-impDeny
and development/7.70.

I have not created the integration branch.

Here are the steps to resolve this conflict:

 $ git fetch
 $ git checkout -B w/7.70/improvement/CLDSRV-428-put-apis-impDeny origin/development/7.70
 $ git merge origin/improvement/CLDSRV-428-put-apis-impDeny
 $ # <intense conflict resolution>
 $ git commit
 $ git push -u origin w/7.70/improvement/CLDSRV-428-put-apis-impDeny

The following options are set: create_integration_branches

benzekrimaha · 2023-11-27T15:59:28Z

ping

bert-e · 2023-11-27T15:59:40Z

Conflict

A conflict has been raised during the creation of
integration branch w/8.6/improvement/CLDSRV-428-put-apis-impDeny with contents from w/7.70/improvement/CLDSRV-428-put-apis-impDeny
and development/8.6.

I have not created the integration branch.

Here are the steps to resolve this conflict:

 $ git fetch
 $ git checkout -B w/8.6/improvement/CLDSRV-428-put-apis-impDeny origin/development/8.6
 $ git merge origin/w/7.70/improvement/CLDSRV-428-put-apis-impDeny
 $ # <intense conflict resolution>
 $ git commit
 $ git push -u origin w/8.6/improvement/CLDSRV-428-put-apis-impDeny

The following options are set: create_integration_branches

benzekrimaha · 2023-11-27T16:02:44Z

ping

bert-e · 2023-11-27T16:02:58Z

Integration data created

I have created the integration data for the additional destination branches.

this pull request will merge improvement/CLDSRV-428-put-apis-impDeny into
development/7.10
w/7.70/improvement/CLDSRV-428-put-apis-impDeny will be merged into development/7.70
w/8.6/improvement/CLDSRV-428-put-apis-impDeny will be merged into development/8.6
w/8.7/improvement/CLDSRV-428-put-apis-impDeny will be merged into development/8.7
w/8.8/improvement/CLDSRV-428-put-apis-impDeny will be merged into development/8.8

The following branches will NOT be impacted:

development/7.4

You can set option create_pull_requests if you need me to create
integration pull requests in addition to integration branches, with:

@bert-e create_pull_requests

The following options are set: create_integration_branches

bert-e · 2023-11-27T16:03:02Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_integration_branches

benzekrimaha · 2023-11-27T16:05:29Z

@bert-e create_pull_requests

bert-e · 2023-11-27T16:05:48Z

Integration data created

I have created the integration data for the additional destination branches.

this pull request will merge improvement/CLDSRV-428-put-apis-impDeny into
development/7.10
w/7.70/improvement/CLDSRV-428-put-apis-impDeny will be merged into development/7.70 (pull request INTEGRATION [PR#5456 > development/7.70] CLDSRV-428: put apis updated for implicit deny #5457)
w/8.6/improvement/CLDSRV-428-put-apis-impDeny will be merged into development/8.6 (pull request INTEGRATION [PR#5456 > development/8.6] CLDSRV-428: put apis updated for implicit deny #5458)
w/8.7/improvement/CLDSRV-428-put-apis-impDeny will be merged into development/8.7 (pull request INTEGRATION [PR#5456 > development/8.7] CLDSRV-428: put apis updated for implicit deny #5459)
w/8.8/improvement/CLDSRV-428-put-apis-impDeny will be merged into development/8.8 (pull request INTEGRATION [PR#5456 > development/8.8] CLDSRV-428: put apis updated for implicit deny #5460)

The following branches will NOT be impacted:

development/7.4

Follow integration pull requests if you would like to be notified of
build statuses by email.

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2023-11-27T16:05:52Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_pull_requests, create_integration_branches

anurag4DSB

LGTM, great work.
I have reviewed this PR and integration PRs as well.

Worth adding a commit on top for package.json, bert-e will port forward the separate commit, integration PRs will have conflicts around versions that you can resolve. This way we can release cloudserver.

bert-e · 2023-11-29T14:10:19Z

Incorrect fix version

The Fix Version/s in issue CLDSRV-428 contains:

7.10.34
7.70.31
8.6.13
8.7.32
8.8.6

Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:

7.10.35
7.70.32
8.6.13
8.7.32
8.8.6

Please check the Fix Version/s of CLDSRV-428, or the target
branch of this pull request.

The following options are set: create_pull_requests, create_integration_branches

anurag4DSB · 2023-11-29T14:14:25Z

ping for version check

bert-e · 2023-11-29T14:14:40Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2023-11-29T14:59:49Z

Conflict

There is a conflict between your branch improvement/CLDSRV-428-put-apis-impDeny and the
destination branch development/7.10.

Please resolve the conflict on the feature branch (improvement/CLDSRV-428-put-apis-impDeny).

git fetch && \
git checkout origin/improvement/CLDSRV-428-put-apis-impDeny && \
git merge origin/development/7.10

Resolve merge conflicts and commit

git push origin HEAD:improvement/CLDSRV-428-put-apis-impDeny

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2023-11-29T15:02:26Z

Conflict

A conflict has been raised during the update of
integration branch w/7.70/improvement/CLDSRV-428-put-apis-impDeny with contents from improvement/CLDSRV-428-put-apis-impDeny
and development/7.70.

Please resolve the conflict on the integration branch (w/7.70/improvement/CLDSRV-428-put-apis-impDeny).

Here are the steps to resolve this conflict:

 $ git fetch
 $ git checkout w/7.70/improvement/CLDSRV-428-put-apis-impDeny
 $ git pull  # or "git reset --hard origin/w/7.70/improvement/CLDSRV-428-put-apis-impDeny"
 $ git merge origin/development/7.70
 $ # <intense conflict resolution>
 $ git commit
 $ git merge origin/improvement/CLDSRV-428-put-apis-impDeny
 $ # <intense conflict resolution>
 $ git commit
 $ git push -u origin w/7.70/improvement/CLDSRV-428-put-apis-impDeny

The following options are set: create_pull_requests, create_integration_branches

benzekrimaha · 2023-11-29T15:10:47Z

ping

bert-e · 2023-11-29T15:10:54Z

Conflict

A conflict has been raised during the update of
integration branch w/8.6/improvement/CLDSRV-428-put-apis-impDeny with contents from w/7.70/improvement/CLDSRV-428-put-apis-impDeny
and development/8.6.

Please resolve the conflict on the integration branch (w/8.6/improvement/CLDSRV-428-put-apis-impDeny).

Here are the steps to resolve this conflict:

 $ git fetch
 $ git checkout w/8.6/improvement/CLDSRV-428-put-apis-impDeny
 $ git pull  # or "git reset --hard origin/w/8.6/improvement/CLDSRV-428-put-apis-impDeny"
 $ git merge origin/development/8.6
 $ # <intense conflict resolution>
 $ git commit
 $ git merge origin/w/7.70/improvement/CLDSRV-428-put-apis-impDeny
 $ # <intense conflict resolution>
 $ git commit
 $ git push -u origin w/8.6/improvement/CLDSRV-428-put-apis-impDeny

The following options are set: create_pull_requests, create_integration_branches

benzekrimaha · 2023-11-29T15:17:29Z

ping

bert-e · 2023-11-29T15:17:32Z

Conflict

A conflict has been raised during the update of
integration branch w/8.7/improvement/CLDSRV-428-put-apis-impDeny with contents from w/8.6/improvement/CLDSRV-428-put-apis-impDeny
and development/8.7.

Please resolve the conflict on the integration branch (w/8.7/improvement/CLDSRV-428-put-apis-impDeny).

Here are the steps to resolve this conflict:

 $ git fetch
 $ git checkout w/8.7/improvement/CLDSRV-428-put-apis-impDeny
 $ git pull  # or "git reset --hard origin/w/8.7/improvement/CLDSRV-428-put-apis-impDeny"
 $ git merge origin/development/8.7
 $ # <intense conflict resolution>
 $ git commit
 $ git merge origin/w/8.6/improvement/CLDSRV-428-put-apis-impDeny
 $ # <intense conflict resolution>
 $ git commit
 $ git push -u origin w/8.7/improvement/CLDSRV-428-put-apis-impDeny

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2023-11-29T15:20:00Z

Conflict

A conflict has been raised during the update of
integration branch w/8.8/improvement/CLDSRV-428-put-apis-impDeny with contents from w/8.7/improvement/CLDSRV-428-put-apis-impDeny
and development/8.8.

Please resolve the conflict on the integration branch (w/8.8/improvement/CLDSRV-428-put-apis-impDeny).

Here are the steps to resolve this conflict:

 $ git fetch
 $ git checkout w/8.8/improvement/CLDSRV-428-put-apis-impDeny
 $ git pull  # or "git reset --hard origin/w/8.8/improvement/CLDSRV-428-put-apis-impDeny"
 $ git merge origin/development/8.8
 $ # <intense conflict resolution>
 $ git commit
 $ git merge origin/w/8.7/improvement/CLDSRV-428-put-apis-impDeny
 $ # <intense conflict resolution>
 $ git commit
 $ git push -u origin w/8.8/improvement/CLDSRV-428-put-apis-impDeny

The following options are set: create_pull_requests, create_integration_branches

benzekrimaha · 2023-11-29T15:23:28Z

ping

bert-e · 2023-11-29T15:23:35Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_pull_requests, create_integration_branches

KazToozs

LGTM too

benzekrimaha · 2023-11-29T17:33:00Z

/approve

bert-e · 2023-11-29T17:33:20Z

In the queue

The changeset has received all authorizations and has been added to the
relevant queue(s). The queue(s) will be merged in the target development
branch(es) as soon as builds have passed.

The changeset will be merged in:

✔️ development/7.10
✔️ development/7.70
✔️ development/8.6
✔️ development/8.7
✔️ development/8.8

The following branches will NOT be impacted:

development/7.4

There is no action required on your side. You will be notified here once
the changeset has been merged. In the unlikely event that the changeset
fails permanently on the queue, a member of the admin team will
contact you to help resolve the matter.

IMPORTANT

Please do not attempt to modify this pull request.

Any commit you add on the source branch will trigger a new cycle after the
current queue is merged.
Any commit you add on one of the integration branches will be lost.

If you need this pull request to be removed from the queue, please contact a
member of the admin team now.

The following options are set: approve, create_pull_requests, create_integration_branches

bert-e · 2023-11-29T17:33:36Z

I have successfully merged the changeset of this pull request
into targetted development branches:

✔️ development/7.10
✔️ development/7.70
✔️ development/8.6
✔️ development/8.7
✔️ development/8.8

The following branches have NOT changed:

development/7.4

Please check the status of the associated issue CLDSRV-428.

Goodbye benzekrimaha.

benzekrimaha force-pushed the improvement/CLDSRV-428-put-apis-impDeny branch from 2079ee8 to a8a63de Compare November 27, 2023 14:55

benzekrimaha force-pushed the improvement/CLDSRV-428-put-apis-impDeny branch from 198f091 to f7fb413 Compare November 27, 2023 15:47

benzekrimaha force-pushed the improvement/CLDSRV-428-put-apis-impDeny branch from f7fb413 to 2596f3f Compare November 27, 2023 15:50

scality deleted a comment from bert-e Nov 27, 2023

benzekrimaha mentioned this pull request Nov 27, 2023

Improvement/cldsrv 428 put apis implicit deny #5450

Closed

benzekrimaha requested review from anurag4DSB and KazToozs November 27, 2023 16:21

benzekrimaha marked this pull request as ready for review November 27, 2023 16:21

benzekrimaha mentioned this pull request Nov 29, 2023

CLDSRV-429: update get apis with impDeny logic #5461

Closed

anurag4DSB approved these changes Nov 29, 2023

View reviewed changes

CLDSRV-428:Bump CLDSRV version

7d10e5d

Merge remote-tracking branch 'origin/development/7.10' into HEAD

b138955

KazToozs approved these changes Nov 29, 2023

View reviewed changes

bert-e merged commit b138955 into development/7.10 Nov 29, 2023
14 checks passed

bert-e deleted the improvement/CLDSRV-428-put-apis-impDeny branch November 29, 2023 17:33

This was referenced Nov 30, 2023

CLDSRV-429: update get apis with impDeny logic #5462

Merged

Improvement/cldsrv 430 delete api implicit deny #5470

Merged

This was referenced Dec 14, 2023

Improvement/cldsrv 431 misc api implicit deny #5479

Merged

improvement/CLDSRV-451-specific-7.70-apis-update #5495

Merged

CLDSRV-428: put apis updated for implicit deny #5456

CLDSRV-428: put apis updated for implicit deny #5456

Conversation

benzekrimaha commented Nov 27, 2023 • edited Loading

bert-e commented Nov 27, 2023

Hello benzekrimaha,

bert-e commented Nov 27, 2023

Request integration branches

benzekrimaha commented Nov 27, 2023

bert-e commented Nov 27, 2023

Conflict

benzekrimaha commented Nov 27, 2023

bert-e commented Nov 27, 2023

Conflict

benzekrimaha commented Nov 27, 2023

bert-e commented Nov 27, 2023

Integration data created

bert-e commented Nov 27, 2023

Waiting for approval

benzekrimaha commented Nov 27, 2023

bert-e commented Nov 27, 2023

Reset complete

benzekrimaha commented Nov 27, 2023

bert-e commented Nov 27, 2023

Conflict

benzekrimaha commented Nov 27, 2023

bert-e commented Nov 27, 2023

Conflict

benzekrimaha commented Nov 27, 2023

bert-e commented Nov 27, 2023

Integration data created

bert-e commented Nov 27, 2023

Waiting for approval

benzekrimaha commented Nov 27, 2023

bert-e commented Nov 27, 2023

Integration data created

bert-e commented Nov 27, 2023

Waiting for approval

anurag4DSB left a comment

Choose a reason for hiding this comment

bert-e commented Nov 29, 2023

Incorrect fix version

anurag4DSB commented Nov 29, 2023

bert-e commented Nov 29, 2023

Waiting for approval

bert-e commented Nov 29, 2023

Conflict

bert-e commented Nov 29, 2023

Conflict

benzekrimaha commented Nov 29, 2023

bert-e commented Nov 29, 2023

Conflict

benzekrimaha commented Nov 29, 2023

bert-e commented Nov 29, 2023

Conflict

bert-e commented Nov 29, 2023

Conflict

benzekrimaha commented Nov 29, 2023

bert-e commented Nov 29, 2023

Waiting for approval

KazToozs left a comment

Choose a reason for hiding this comment

benzekrimaha commented Nov 29, 2023

bert-e commented Nov 29, 2023

In the queue

bert-e commented Nov 29, 2023

benzekrimaha commented Nov 27, 2023 •

edited

Loading