1 # -*- coding: utf-8 -*- 2 # Copyright 2013 Google Inc. All Rights Reserved. 3 # 4 # Licensed under the Apache License, Version 2.0 (the "License"); 5 # you may not use this file except in compliance with the License. 6 # You may obtain a copy of the License at 7 # 8 # http://www.apache.org/licenses/LICENSE-2.0 9 # 10 # Unless required by applicable law or agreed to in writing, software 11 # distributed under the License is distributed on an "AS IS" BASIS, 12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 # See the License for the specific language governing permissions and 14 # limitations under the License. 15 """Integration tests for the acl command.""" 16 17 from __future__ import absolute_import 18 19 import re 20 21 from gslib import aclhelpers 22 from gslib.command import CreateGsutilLogger 23 from gslib.cs_api_map import ApiSelector 24 from gslib.project_id import PopulateProjectId 25 from gslib.storage_url import StorageUrlFromString 26 import gslib.tests.testcase as testcase 27 from gslib.tests.testcase.integration_testcase import SkipForGS 28 from gslib.tests.testcase.integration_testcase import SkipForS3 29 from gslib.tests.util import ObjectToURI as suri 30 from gslib.translation_helper import AclTranslation 31 from gslib.util import Retry 32 33 PUBLIC_READ_JSON_ACL_TEXT = '"entity":"allUsers","role":"READER"' 34 35 36 class TestAclBase(testcase.GsUtilIntegrationTestCase): 37 """Integration test case base class for acl command.""" 38 39 _set_acl_prefix = ['acl', 'set'] 40 _get_acl_prefix = ['acl', 'get'] 41 _set_defacl_prefix = ['defacl', 'set'] 42 _ch_acl_prefix = ['acl', 'ch'] 43 44 _project_team = 'owners' 45 _project_test_acl = '%s-%s' % (_project_team, PopulateProjectId()) 46 47 48 @SkipForS3('Tests use GS ACL model.') 49 class TestAcl(TestAclBase): 50 """Integration tests for acl command.""" 51 52 def setUp(self): 53 super(TestAcl, self).setUp() 54 self.sample_uri = self.CreateBucket() 55 self.sample_url = StorageUrlFromString(str(self.sample_uri)) 56 self.logger = CreateGsutilLogger('acl') 57 58 def test_set_invalid_acl_object(self): 59 """Ensures that invalid content returns a bad request error.""" 60 obj_uri = suri(self.CreateObject(contents='foo')) 61 inpath = self.CreateTempFile(contents='badAcl') 62 stderr = self.RunGsUtil(self._set_acl_prefix + [inpath, obj_uri], 63 return_stderr=True, expected_status=1) 64 self.assertIn('ArgumentException', stderr) 65 66 def test_set_invalid_acl_bucket(self): 67 """Ensures that invalid content returns a bad request error.""" 68 bucket_uri = suri(self.CreateBucket()) 69 inpath = self.CreateTempFile(contents='badAcl') 70 stderr = self.RunGsUtil(self._set_acl_prefix + [inpath, bucket_uri], 71 return_stderr=True, expected_status=1) 72 self.assertIn('ArgumentException', stderr) 73 74 def test_set_xml_acl_json_api_object(self): 75 """Ensures XML content returns a bad request error and migration warning.""" 76 obj_uri = suri(self.CreateObject(contents='foo')) 77 inpath = self.CreateTempFile(contents='<ValidXml></ValidXml>') 78 stderr = self.RunGsUtil(self._set_acl_prefix + [inpath, obj_uri], 79 return_stderr=True, expected_status=1) 80 self.assertIn('ArgumentException', stderr) 81 self.assertIn('XML ACL data provided', stderr) 82 83 def test_set_xml_acl_json_api_bucket(self): 84 """Ensures XML content returns a bad request error and migration warning.""" 85 bucket_uri = suri(self.CreateBucket()) 86 inpath = self.CreateTempFile(contents='<ValidXml></ValidXml>') 87 stderr = self.RunGsUtil(self._set_acl_prefix + [inpath, bucket_uri], 88 return_stderr=True, expected_status=1) 89 self.assertIn('ArgumentException', stderr) 90 self.assertIn('XML ACL data provided', stderr) 91 92 def test_set_valid_acl_object(self): 93 """Tests setting a valid ACL on an object.""" 94 obj_uri = suri(self.CreateObject(contents='foo')) 95 acl_string = self.RunGsUtil(self._get_acl_prefix + [obj_uri], 96 return_stdout=True) 97 inpath = self.CreateTempFile(contents=acl_string) 98 self.RunGsUtil(self._set_acl_prefix + ['public-read', obj_uri]) 99 acl_string2 = self.RunGsUtil(self._get_acl_prefix + [obj_uri], 100 return_stdout=True) 101 self.RunGsUtil(self._set_acl_prefix + [inpath, obj_uri]) 102 acl_string3 = self.RunGsUtil(self._get_acl_prefix + [obj_uri], 103 return_stdout=True) 104 105 self.assertNotEqual(acl_string, acl_string2) 106 self.assertEqual(acl_string, acl_string3) 107 108 def test_set_valid_permission_whitespace_object(self): 109 """Ensures that whitespace is allowed in role and entity elements.""" 110 obj_uri = suri(self.CreateObject(contents='foo')) 111 acl_string = self.RunGsUtil(self._get_acl_prefix + [obj_uri], 112 return_stdout=True) 113 acl_string = re.sub(r'"role"', r'"role" \n', acl_string) 114 acl_string = re.sub(r'"entity"', r'\n "entity"', acl_string) 115 inpath = self.CreateTempFile(contents=acl_string) 116 117 self.RunGsUtil(self._set_acl_prefix + [inpath, obj_uri]) 118 119 def test_set_valid_acl_bucket(self): 120 """Ensures that valid canned and XML ACLs work with get/set.""" 121 bucket_uri = suri(self.CreateBucket()) 122 acl_string = self.RunGsUtil(self._get_acl_prefix + [bucket_uri], 123 return_stdout=True) 124 inpath = self.CreateTempFile(contents=acl_string) 125 self.RunGsUtil(self._set_acl_prefix + ['public-read', bucket_uri]) 126 acl_string2 = self.RunGsUtil(self._get_acl_prefix + [bucket_uri], 127 return_stdout=True) 128 self.RunGsUtil(self._set_acl_prefix + [inpath, bucket_uri]) 129 acl_string3 = self.RunGsUtil(self._get_acl_prefix + [bucket_uri], 130 return_stdout=True) 131 132 self.assertNotEqual(acl_string, acl_string2) 133 self.assertEqual(acl_string, acl_string3) 134 135 def test_invalid_canned_acl_object(self): 136 """Ensures that an invalid canned ACL returns a CommandException.""" 137 obj_uri = suri(self.CreateObject(contents='foo')) 138 stderr = self.RunGsUtil( 139 self._set_acl_prefix + ['not-a-canned-acl', obj_uri], 140 return_stderr=True, expected_status=1) 141 self.assertIn('CommandException', stderr) 142 self.assertIn('Invalid canned ACL', stderr) 143 144 def test_set_valid_def_acl_bucket(self): 145 """Ensures that valid default canned and XML ACLs works with get/set.""" 146 bucket_uri = self.CreateBucket() 147 148 # Default ACL is project private. 149 obj_uri1 = suri(self.CreateObject(bucket_uri=bucket_uri, contents='foo')) 150 acl_string = self.RunGsUtil(self._get_acl_prefix + [obj_uri1], 151 return_stdout=True) 152 153 # Change it to authenticated-read. 154 self.RunGsUtil( 155 self._set_defacl_prefix + ['authenticated-read', suri(bucket_uri)]) 156 obj_uri2 = suri(self.CreateObject(bucket_uri=bucket_uri, contents='foo2')) 157 acl_string2 = self.RunGsUtil(self._get_acl_prefix + [obj_uri2], 158 return_stdout=True) 159 160 # Now change it back to the default via XML. 161 inpath = self.CreateTempFile(contents=acl_string) 162 self.RunGsUtil(self._set_defacl_prefix + [inpath, suri(bucket_uri)]) 163 obj_uri3 = suri(self.CreateObject(bucket_uri=bucket_uri, contents='foo3')) 164 acl_string3 = self.RunGsUtil(self._get_acl_prefix + [obj_uri3], 165 return_stdout=True) 166 167 self.assertNotEqual(acl_string, acl_string2) 168 self.assertIn('allAuthenticatedUsers', acl_string2) 169 self.assertEqual(acl_string, acl_string3) 170 171 def test_acl_set_version_specific_uri(self): 172 """Tests setting an ACL on a specific version of an object.""" 173 bucket_uri = self.CreateVersionedBucket() 174 # Create initial object version. 175 uri = self.CreateObject(bucket_uri=bucket_uri, contents='data') 176 # Create a second object version. 177 inpath = self.CreateTempFile(contents='def') 178 self.RunGsUtil(['cp', inpath, uri.uri]) 179 180 # Find out the two object version IDs. 181 lines = self.AssertNObjectsInBucket(bucket_uri, 2, versioned=True) 182 v0_uri_str, v1_uri_str = lines[0], lines[1] 183 184 # Check that neither version currently has public-read permission 185 # (default ACL is project-private). 186 orig_acls = [] 187 for uri_str in (v0_uri_str, v1_uri_str): 188 acl = self.RunGsUtil(self._get_acl_prefix + [uri_str], 189 return_stdout=True) 190 self.assertNotIn(PUBLIC_READ_JSON_ACL_TEXT, 191 self._strip_json_whitespace(acl)) 192 orig_acls.append(acl) 193 194 # Set the ACL for the older version of the object to public-read. 195 self.RunGsUtil(self._set_acl_prefix + ['public-read', v0_uri_str]) 196 # Check that the older version's ACL is public-read, but newer version 197 # is not. 198 acl = self.RunGsUtil(self._get_acl_prefix + [v0_uri_str], 199 return_stdout=True) 200 self.assertIn(PUBLIC_READ_JSON_ACL_TEXT, self._strip_json_whitespace(acl)) 201 acl = self.RunGsUtil(self._get_acl_prefix + [v1_uri_str], 202 return_stdout=True) 203 self.assertNotIn(PUBLIC_READ_JSON_ACL_TEXT, 204 self._strip_json_whitespace(acl)) 205 206 # Check that reading the ACL with the version-less URI returns the 207 # original ACL (since the version-less URI means the current version). 208 acl = self.RunGsUtil(self._get_acl_prefix + [uri.uri], return_stdout=True) 209 self.assertEqual(acl, orig_acls[0]) 210 211 def _strip_json_whitespace(self, json_text): 212 return re.sub(r'\s*', '', json_text) 213 214 def testAclChangeWithUserId(self): 215 change = aclhelpers.AclChange(self.USER_TEST_ID + ':r', 216 scope_type=aclhelpers.ChangeType.USER) 217 acl = list(AclTranslation.BotoBucketAclToMessage(self.sample_uri.get_acl())) 218 change.Execute(self.sample_url, acl, 'acl', self.logger) 219 self._AssertHas(acl, 'READER', 'UserById', self.USER_TEST_ID) 220 221 def testAclChangeWithGroupId(self): 222 change = aclhelpers.AclChange(self.GROUP_TEST_ID + ':r', 223 scope_type=aclhelpers.ChangeType.GROUP) 224 acl = list(AclTranslation.BotoBucketAclToMessage(self.sample_uri.get_acl())) 225 change.Execute(self.sample_url, acl, 'acl', self.logger) 226 self._AssertHas(acl, 'READER', 'GroupById', self.GROUP_TEST_ID) 227 228 def testAclChangeWithUserEmail(self): 229 change = aclhelpers.AclChange(self.USER_TEST_ADDRESS + ':r', 230 scope_type=aclhelpers.ChangeType.USER) 231 acl = list(AclTranslation.BotoBucketAclToMessage(self.sample_uri.get_acl())) 232 change.Execute(self.sample_url, acl, 'acl', self.logger) 233 self._AssertHas(acl, 'READER', 'UserByEmail', self.USER_TEST_ADDRESS) 234 235 def testAclChangeWithGroupEmail(self): 236 change = aclhelpers.AclChange(self.GROUP_TEST_ADDRESS + ':fc', 237 scope_type=aclhelpers.ChangeType.GROUP) 238 acl = list(AclTranslation.BotoBucketAclToMessage(self.sample_uri.get_acl())) 239 change.Execute(self.sample_url, acl, 'acl', self.logger) 240 self._AssertHas(acl, 'OWNER', 'GroupByEmail', self.GROUP_TEST_ADDRESS) 241 242 def testAclChangeWithDomain(self): 243 change = aclhelpers.AclChange(self.DOMAIN_TEST + ':READ', 244 scope_type=aclhelpers.ChangeType.GROUP) 245 acl = list(AclTranslation.BotoBucketAclToMessage(self.sample_uri.get_acl())) 246 change.Execute(self.sample_url, acl, 'acl', self.logger) 247 self._AssertHas(acl, 'READER', 'GroupByDomain', self.DOMAIN_TEST) 248 249 def testAclChangeWithProjectOwners(self): 250 change = aclhelpers.AclChange(self._project_test_acl + ':READ', 251 scope_type=aclhelpers.ChangeType.PROJECT) 252 acl = list(AclTranslation.BotoBucketAclToMessage(self.sample_uri.get_acl())) 253 change.Execute(self.sample_url, acl, 'acl', self.logger) 254 self._AssertHas(acl, 'READER', 'Project', self._project_test_acl) 255 256 def testAclChangeWithAllUsers(self): 257 change = aclhelpers.AclChange('AllUsers:WRITE', 258 scope_type=aclhelpers.ChangeType.GROUP) 259 acl = list(AclTranslation.BotoBucketAclToMessage(self.sample_uri.get_acl())) 260 change.Execute(self.sample_url, acl, 'acl', self.logger) 261 self._AssertHas(acl, 'WRITER', 'AllUsers') 262 263 def testAclChangeWithAllAuthUsers(self): 264 change = aclhelpers.AclChange('AllAuthenticatedUsers:READ', 265 scope_type=aclhelpers.ChangeType.GROUP) 266 acl = list(AclTranslation.BotoBucketAclToMessage(self.sample_uri.get_acl())) 267 change.Execute(self.sample_url, acl, 'acl', self.logger) 268 self._AssertHas(acl, 'READER', 'AllAuthenticatedUsers') 269 remove = aclhelpers.AclDel('AllAuthenticatedUsers') 270 remove.Execute(self.sample_url, acl, 'acl', self.logger) 271 self._AssertHasNo(acl, 'READER', 'AllAuthenticatedUsers') 272 273 def testAclDelWithUser(self): 274 add = aclhelpers.AclChange(self.USER_TEST_ADDRESS + ':READ', 275 scope_type=aclhelpers.ChangeType.USER) 276 acl = list(AclTranslation.BotoBucketAclToMessage(self.sample_uri.get_acl())) 277 add.Execute(self.sample_url, acl, 'acl', self.logger) 278 self._AssertHas(acl, 'READER', 'UserByEmail', self.USER_TEST_ADDRESS) 279 280 remove = aclhelpers.AclDel(self.USER_TEST_ADDRESS) 281 remove.Execute(self.sample_url, acl, 'acl', self.logger) 282 self._AssertHasNo(acl, 'READ', 'UserByEmail', self.USER_TEST_ADDRESS) 283 284 def testAclDelWithProjectOwners(self): 285 add = aclhelpers.AclChange(self._project_test_acl + ':READ', 286 scope_type=aclhelpers.ChangeType.PROJECT) 287 acl = list(AclTranslation.BotoBucketAclToMessage(self.sample_uri.get_acl())) 288 add.Execute(self.sample_url, acl, 'acl', self.logger) 289 self._AssertHas(acl, 'READER', 'Project', self._project_test_acl) 290 291 remove = aclhelpers.AclDel(self._project_test_acl) 292 remove.Execute(self.sample_url, acl, 'acl', self.logger) 293 self._AssertHasNo(acl, 'READ', 'Project', self._project_test_acl) 294 295 def testAclDelWithGroup(self): 296 add = aclhelpers.AclChange(self.USER_TEST_ADDRESS + ':READ', 297 scope_type=aclhelpers.ChangeType.GROUP) 298 acl = list(AclTranslation.BotoBucketAclToMessage(self.sample_uri.get_acl())) 299 add.Execute(self.sample_url, acl, 'acl', self.logger) 300 self._AssertHas(acl, 'READER', 'GroupByEmail', self.USER_TEST_ADDRESS) 301 302 remove = aclhelpers.AclDel(self.USER_TEST_ADDRESS) 303 remove.Execute(self.sample_url, acl, 'acl', self.logger) 304 self._AssertHasNo(acl, 'READER', 'GroupByEmail', self.GROUP_TEST_ADDRESS) 305 306 # 307 # Here are a whole lot of verbose asserts 308 # 309 310 def _AssertHas(self, current_acl, perm, scope, value=None): 311 matches = list(self._YieldMatchingEntriesJson(current_acl, perm, scope, 312 value)) 313 self.assertEqual(1, len(matches)) 314 315 def _AssertHasNo(self, current_acl, perm, scope, value=None): 316 matches = list(self._YieldMatchingEntriesJson(current_acl, perm, scope, 317 value)) 318 self.assertEqual(0, len(matches)) 319 320 def _YieldMatchingEntriesJson(self, current_acl, perm, scope, value=None): 321 """Generator that yields entries that match the change descriptor. 322 323 Args: 324 current_acl: A list of apitools_messages.BucketAccessControls or 325 ObjectAccessControls which will be searched for matching 326 entries. 327 perm: Role (permission) to match. 328 scope: Scope type to match. 329 value: Value to match (against the scope type). 330 331 Yields: 332 An apitools_messages.BucketAccessControl or ObjectAccessControl. 333 """ 334 for entry in current_acl: 335 if (scope in ['UserById', 'GroupById'] and 336 entry.entityId and value == entry.entityId and 337 entry.role == perm): 338 yield entry 339 elif (scope in ['UserByEmail', 'GroupByEmail'] and 340 entry.email and value == entry.email and 341 entry.role == perm): 342 yield entry 343 elif (scope == 'GroupByDomain' and 344 entry.domain and value == entry.domain and 345 entry.role == perm): 346 yield entry 347 elif (scope == 'Project' and entry.role == perm and 348 value == entry.entityId): 349 yield entry 350 elif (scope in ['AllUsers', 'AllAuthenticatedUsers'] and 351 entry.entity.lower() == scope.lower() and 352 entry.role == perm): 353 yield entry 354 355 def _MakeScopeRegex(self, role, entity_type, email_address): 356 template_regex = (r'\{.*"entity":\s*"%s-%s".*"role":\s*"%s".*\}' % 357 (entity_type, email_address, role)) 358 return re.compile(template_regex, flags=re.DOTALL) 359 360 def _MakeProjectScopeRegex(self, role, project_team): 361 template_regex = (r'\{.*"entity":\s*"project-%s-\d+",\s*"projectTeam":\s*' 362 r'\{\s*"projectNumber":\s*"(\d+)",\s*"team":\s*"%s"\s*\},' 363 r'\s*"role":\s*"%s".*\}') % (project_team, project_team, 364 role) 365 366 return re.compile(template_regex, flags=re.DOTALL) 367 368 def testBucketAclChange(self): 369 """Tests acl change on a bucket.""" 370 test_regex = self._MakeScopeRegex( 371 'OWNER', 'user', self.USER_TEST_ADDRESS) 372 json_text = self.RunGsUtil( 373 self._get_acl_prefix + [suri(self.sample_uri)], return_stdout=True) 374 self.assertNotRegexpMatches(json_text, test_regex) 375 376 self.RunGsUtil(self._ch_acl_prefix + 377 ['-u', self.USER_TEST_ADDRESS+':fc', suri(self.sample_uri)]) 378 json_text = self.RunGsUtil( 379 self._get_acl_prefix + [suri(self.sample_uri)], return_stdout=True) 380 self.assertRegexpMatches(json_text, test_regex) 381 382 test_regex2 = self._MakeScopeRegex( 383 'WRITER', 'user', self.USER_TEST_ADDRESS) 384 self.RunGsUtil(self._ch_acl_prefix + 385 ['-u', self.USER_TEST_ADDRESS+':w', suri(self.sample_uri)]) 386 json_text2 = self.RunGsUtil( 387 self._get_acl_prefix + [suri(self.sample_uri)], return_stdout=True) 388 self.assertRegexpMatches(json_text2, test_regex2) 389 390 self.RunGsUtil(self._ch_acl_prefix + 391 ['-d', self.USER_TEST_ADDRESS, suri(self.sample_uri)]) 392 393 json_text3 = self.RunGsUtil( 394 self._get_acl_prefix + [suri(self.sample_uri)], return_stdout=True) 395 self.assertNotRegexpMatches(json_text3, test_regex) 396 397 def testProjectAclChangesOnBucket(self): 398 """Tests project entity acl changes on a bucket.""" 399 400 if self.test_api == ApiSelector.XML: 401 stderr = self.RunGsUtil(self._ch_acl_prefix + 402 ['-p', self._project_test_acl +':w', 403 suri(self.sample_uri)], 404 expected_status=1, 405 return_stderr=True) 406 self.assertIn(('CommandException: XML API does not support project' 407 ' scopes, cannot translate ACL.'), stderr) 408 else: 409 test_regex = self._MakeProjectScopeRegex( 410 'WRITER', self._project_team) 411 self.RunGsUtil(self._ch_acl_prefix + 412 ['-p', self._project_test_acl +':w', 413 suri(self.sample_uri)]) 414 json_text = self.RunGsUtil( 415 self._get_acl_prefix + [suri(self.sample_uri)], return_stdout=True) 416 417 self.assertRegexpMatches(json_text, test_regex) 418 419 # The api will accept string project ids, but stores the numeric project 420 # ids internally, this extracts the numeric id from the returned acls. 421 proj_num_id = test_regex.search(json_text).group(1) 422 acl_to_remove = '%s-%s' % (self._project_team, proj_num_id) 423 424 self.RunGsUtil(self._ch_acl_prefix + 425 ['-d', acl_to_remove, suri(self.sample_uri)]) 426 427 json_text2 = self.RunGsUtil( 428 self._get_acl_prefix + [suri(self.sample_uri)], return_stdout=True) 429 self.assertNotRegexpMatches(json_text2, test_regex) 430 431 def testObjectAclChange(self): 432 """Tests acl change on an object.""" 433 obj = self.CreateObject(bucket_uri=self.sample_uri, contents='something') 434 self.AssertNObjectsInBucket(self.sample_uri, 1) 435 436 test_regex = self._MakeScopeRegex( 437 'READER', 'group', self.GROUP_TEST_ADDRESS) 438 json_text = self.RunGsUtil(self._get_acl_prefix + [suri(obj)], 439 return_stdout=True) 440 self.assertNotRegexpMatches(json_text, test_regex) 441 442 self.RunGsUtil(self._ch_acl_prefix + 443 ['-g', self.GROUP_TEST_ADDRESS+':READ', suri(obj)]) 444 json_text = self.RunGsUtil(self._get_acl_prefix + [suri(obj)], 445 return_stdout=True) 446 self.assertRegexpMatches(json_text, test_regex) 447 448 test_regex2 = self._MakeScopeRegex( 449 'OWNER', 'group', self.GROUP_TEST_ADDRESS) 450 self.RunGsUtil(self._ch_acl_prefix + 451 ['-g', self.GROUP_TEST_ADDRESS+':OWNER', suri(obj)]) 452 json_text2 = self.RunGsUtil(self._get_acl_prefix + [suri(obj)], 453 return_stdout=True) 454 self.assertRegexpMatches(json_text2, test_regex2) 455 456 self.RunGsUtil(self._ch_acl_prefix + 457 ['-d', self.GROUP_TEST_ADDRESS, suri(obj)]) 458 json_text3 = self.RunGsUtil(self._get_acl_prefix + [suri(obj)], 459 return_stdout=True) 460 self.assertNotRegexpMatches(json_text3, test_regex2) 461 462 all_auth_regex = re.compile( 463 r'\{.*"entity":\s*"allAuthenticatedUsers".*"role":\s*"OWNER".*\}', 464 flags=re.DOTALL) 465 466 self.RunGsUtil(self._ch_acl_prefix + ['-g', 'AllAuth:O', suri(obj)]) 467 json_text4 = self.RunGsUtil(self._get_acl_prefix + [suri(obj)], 468 return_stdout=True) 469 self.assertRegexpMatches(json_text4, all_auth_regex) 470 471 def testObjectAclChangeAllUsers(self): 472 """Tests acl ch AllUsers:R on an object.""" 473 obj = self.CreateObject(bucket_uri=self.sample_uri, contents='something') 474 self.AssertNObjectsInBucket(self.sample_uri, 1) 475 476 all_users_regex = re.compile( 477 r'\{.*"entity":\s*"allUsers".*"role":\s*"READER".*\}', flags=re.DOTALL) 478 json_text = self.RunGsUtil(self._get_acl_prefix + [suri(obj)], 479 return_stdout=True) 480 self.assertNotRegexpMatches(json_text, all_users_regex) 481 482 self.RunGsUtil(self._ch_acl_prefix + 483 ['-g', 'AllUsers:R', suri(obj)]) 484 json_text = self.RunGsUtil(self._get_acl_prefix + [suri(obj)], 485 return_stdout=True) 486 self.assertRegexpMatches(json_text, all_users_regex) 487 488 def testMultithreadedAclChange(self, count=10): 489 """Tests multi-threaded acl changing on several objects.""" 490 objects = [] 491 for i in range(count): 492 objects.append(self.CreateObject( 493 bucket_uri=self.sample_uri, 494 contents='something {0}'.format(i))) 495 496 self.AssertNObjectsInBucket(self.sample_uri, count) 497 498 test_regex = self._MakeScopeRegex( 499 'READER', 'group', self.GROUP_TEST_ADDRESS) 500 json_texts = [] 501 for obj in objects: 502 json_texts.append(self.RunGsUtil( 503 self._get_acl_prefix + [suri(obj)], return_stdout=True)) 504 for json_text in json_texts: 505 self.assertNotRegexpMatches(json_text, test_regex) 506 507 uris = [suri(obj) for obj in objects] 508 self.RunGsUtil(['-m', '-DD'] + self._ch_acl_prefix + 509 ['-g', self.GROUP_TEST_ADDRESS+':READ'] + uris) 510 511 json_texts = [] 512 for obj in objects: 513 json_texts.append(self.RunGsUtil( 514 self._get_acl_prefix + [suri(obj)], return_stdout=True)) 515 for json_text in json_texts: 516 self.assertRegexpMatches(json_text, test_regex) 517 518 def testRecursiveChangeAcl(self): 519 """Tests recursively changing ACLs on nested objects.""" 520 obj = self.CreateObject(bucket_uri=self.sample_uri, object_name='foo/bar', 521 contents='something') 522 self.AssertNObjectsInBucket(self.sample_uri, 1) 523 524 test_regex = self._MakeScopeRegex( 525 'READER', 'group', self.GROUP_TEST_ADDRESS) 526 json_text = self.RunGsUtil(self._get_acl_prefix + [suri(obj)], 527 return_stdout=True) 528 self.assertNotRegexpMatches(json_text, test_regex) 529 530 @Retry(AssertionError, tries=5, timeout_secs=1) 531 def _AddAcl(): 532 self.RunGsUtil( 533 self._ch_acl_prefix + 534 ['-R', '-g', self.GROUP_TEST_ADDRESS+':READ', suri(obj)[:-3]]) 535 json_text = self.RunGsUtil(self._get_acl_prefix + [suri(obj)], 536 return_stdout=True) 537 self.assertRegexpMatches(json_text, test_regex) 538 _AddAcl() 539 540 @Retry(AssertionError, tries=5, timeout_secs=1) 541 def _DeleteAcl(): 542 self.RunGsUtil(self._ch_acl_prefix + 543 ['-d', self.GROUP_TEST_ADDRESS, suri(obj)]) 544 json_text = self.RunGsUtil(self._get_acl_prefix + [suri(obj)], 545 return_stdout=True) 546 self.assertNotRegexpMatches(json_text, test_regex) 547 _DeleteAcl() 548 549 def testMultiVersionSupport(self): 550 """Tests changing ACLs on multiple object versions.""" 551 bucket = self.CreateVersionedBucket() 552 object_name = self.MakeTempName('obj') 553 self.CreateObject( 554 bucket_uri=bucket, object_name=object_name, contents='One thing') 555 # Create another on the same URI, giving us a second version. 556 self.CreateObject( 557 bucket_uri=bucket, object_name=object_name, contents='Another thing') 558 559 lines = self.AssertNObjectsInBucket(bucket, 2, versioned=True) 560 561 obj_v1, obj_v2 = lines[0], lines[1] 562 563 test_regex = self._MakeScopeRegex( 564 'READER', 'group', self.GROUP_TEST_ADDRESS) 565 json_text = self.RunGsUtil(self._get_acl_prefix + [obj_v1], 566 return_stdout=True) 567 self.assertNotRegexpMatches(json_text, test_regex) 568 569 self.RunGsUtil(self._ch_acl_prefix + 570 ['-g', self.GROUP_TEST_ADDRESS+':READ', obj_v1]) 571 json_text = self.RunGsUtil(self._get_acl_prefix + [obj_v1], 572 return_stdout=True) 573 self.assertRegexpMatches(json_text, test_regex) 574 575 json_text = self.RunGsUtil(self._get_acl_prefix + [obj_v2], 576 return_stdout=True) 577 self.assertNotRegexpMatches(json_text, test_regex) 578 579 def testBadRequestAclChange(self): 580 stdout, stderr = self.RunGsUtil( 581 self._ch_acl_prefix + 582 ['-u', 'invalid_$$@hello.com:R', suri(self.sample_uri)], 583 return_stdout=True, return_stderr=True, expected_status=1) 584 self.assertIn('BadRequestException', stderr) 585 self.assertNotIn('Retrying', stdout) 586 self.assertNotIn('Retrying', stderr) 587 588 def testAclGetWithoutFullControl(self): 589 object_uri = self.CreateObject(contents='foo') 590 with self.SetAnonymousBotoCreds(): 591 stderr = self.RunGsUtil(self._get_acl_prefix + [suri(object_uri)], 592 return_stderr=True, expected_status=1) 593 self.assertIn('AccessDeniedException', stderr) 594 595 def testTooFewArgumentsFails(self): 596 """Tests calling ACL commands with insufficient number of arguments.""" 597 # No arguments for get, but valid subcommand. 598 stderr = self.RunGsUtil(self._get_acl_prefix, return_stderr=True, 599 expected_status=1) 600 self.assertIn('command requires at least', stderr) 601 602 # No arguments for set, but valid subcommand. 603 stderr = self.RunGsUtil(self._set_acl_prefix, return_stderr=True, 604 expected_status=1) 605 self.assertIn('command requires at least', stderr) 606 607 # No arguments for ch, but valid subcommand. 608 stderr = self.RunGsUtil(self._ch_acl_prefix, return_stderr=True, 609 expected_status=1) 610 self.assertIn('command requires at least', stderr) 611 612 # Neither arguments nor subcommand. 613 stderr = self.RunGsUtil(['acl'], return_stderr=True, expected_status=1) 614 self.assertIn('command requires at least', stderr) 615 616 def testMinusF(self): 617 """Tests -f option to continue after failure.""" 618 bucket_uri = self.CreateBucket() 619 obj_uri = suri(self.CreateObject(bucket_uri=bucket_uri, object_name='foo', 620 contents='foo')) 621 acl_string = self.RunGsUtil(self._get_acl_prefix + [obj_uri], 622 return_stdout=True) 623 self.RunGsUtil(self._set_acl_prefix + 624 ['-f', 'public-read', suri(bucket_uri) + 'foo2', obj_uri], 625 expected_status=1) 626 acl_string2 = self.RunGsUtil(self._get_acl_prefix + [obj_uri], 627 return_stdout=True) 628 629 self.assertNotEqual(acl_string, acl_string2) 630 631 632 class TestS3CompatibleAcl(TestAclBase): 633 """ACL integration tests that work for s3 and gs URLs.""" 634 635 def testAclObjectGetSet(self): 636 bucket_uri = self.CreateBucket() 637 obj_uri = self.CreateObject(bucket_uri=bucket_uri, contents='foo') 638 self.AssertNObjectsInBucket(bucket_uri, 1) 639 640 stdout = self.RunGsUtil(self._get_acl_prefix + [suri(obj_uri)], 641 return_stdout=True) 642 set_contents = self.CreateTempFile(contents=stdout) 643 self.RunGsUtil(self._set_acl_prefix + [set_contents, suri(obj_uri)]) 644 645 def testAclBucketGetSet(self): 646 bucket_uri = self.CreateBucket() 647 stdout = self.RunGsUtil(self._get_acl_prefix + [suri(bucket_uri)], 648 return_stdout=True) 649 set_contents = self.CreateTempFile(contents=stdout) 650 self.RunGsUtil(self._set_acl_prefix + [set_contents, suri(bucket_uri)]) 651 652 653 @SkipForGS('S3 ACLs accept XML and should not cause an XML warning.') 654 class TestS3OnlyAcl(TestAclBase): 655 """ACL integration tests that work only for s3 URLs.""" 656 657 # TODO: Format all test case names consistently. 658 def test_set_xml_acl(self): 659 """Ensures XML content does not return an XML warning for S3.""" 660 obj_uri = suri(self.CreateObject(contents='foo')) 661 inpath = self.CreateTempFile(contents='<ValidXml></ValidXml>') 662 stderr = self.RunGsUtil(self._set_acl_prefix + [inpath, obj_uri], 663 return_stderr=True, expected_status=1) 664 self.assertIn('BadRequestException', stderr) 665 self.assertNotIn('XML ACL data provided', stderr) 666 667 def test_set_xml_acl_bucket(self): 668 """Ensures XML content does not return an XML warning for S3.""" 669 bucket_uri = suri(self.CreateBucket()) 670 inpath = self.CreateTempFile(contents='<ValidXml></ValidXml>') 671 stderr = self.RunGsUtil(self._set_acl_prefix + [inpath, bucket_uri], 672 return_stderr=True, expected_status=1) 673 self.assertIn('BadRequestException', stderr) 674 self.assertNotIn('XML ACL data provided', stderr) 675 676 677 class TestAclOldAlias(TestAcl): 678 _set_acl_prefix = ['setacl'] 679 _get_acl_prefix = ['getacl'] 680 _set_defacl_prefix = ['setdefacl'] 681 _ch_acl_prefix = ['chacl'] 682
