Default bearer rules contain mutually opposite rules #387

New issue

Closed

opened 2025-12-28 17:37:12 +00:00 by sami · 0 comments

sami commented

2025-12-28 17:37:12 +00:00

Owner

Originally created by @cthulhu-rider on GitHub (Sep 13, 2023).

Originally assigned to: @smallhive on GitHub.

according to Authmate docs, it generates following bearer access rules:

{
    "records": [
       {"operation": "GET", "action": "ALLOW", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]},

       {"operation": "GET", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]},
       {"operation": "HEAD", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]},
       {"operation": "PUT", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]},
       {"operation": "DELETE", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]},
       {"operation": "SEARCH", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]},
       {"operation": "GETRANGE", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]},
       {"operation": "GETRANGEHASH", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]}
    ]
}

as we can see, first two rules are similar and have opposite actions. According to the NeoFS protocol, only the 1st record will be processed, and the 2nd will always be ignored (so it's redundant).

Code matches docs
nspcc-dev/neofs-s3-gw@49d12472ae/authmate/authmate.go (L315-L344)

i propose to get rid of no-op record

Originally created by @cthulhu-rider on GitHub (Sep 13, 2023). Originally assigned to: @smallhive on GitHub. according to Authmate [docs](https://github.com/nspcc-dev/neofs-s3-gw/blob/v0.28.2/docs/authmate.md#bearer-tokens), it generates following bearer access rules: ```json { "records": [ {"operation": "GET", "action": "ALLOW", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]}, {"operation": "GET", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]}, {"operation": "HEAD", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]}, {"operation": "PUT", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]}, {"operation": "DELETE", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]}, {"operation": "SEARCH", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]}, {"operation": "GETRANGE", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]}, {"operation": "GETRANGEHASH", "action": "DENY", "filters": [], "targets": [{"role": "OTHERS", "keys": []}]} ] } ``` as we can see, first two rules are similar and have opposite actions. According to the NeoFS protocol, only the 1st record will be processed, and the 2nd will always be ignored (so it's redundant). Code matches docs https://github.com/nspcc-dev/neofs-s3-gw/blob/49d12472aeaeecd4db1ee44dc5c8bac42dd9f940/authmate/authmate.go#L315-L344 i propose to get rid of no-op record