acl: Extend BearerToken message with issuer field

Previously, `BearerToken` message had no explicit field for the token issuer. This could become a limitation on subject identification because only public key derivation was supported. To prevent this, `issuer` field is added. Closes #266. Signed-off-by: Leonard Lyubich <[email protected]>
nspcc-dev · Feb 26, 2024 · f49089f · f49089f
1 parent dcead71
commit f49089f
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,7 @@
 - Link object payload message (#263)
 - Children sizes index to the link objects (#264)
 - `LINK` split chain object type (#283)
+- `BearerToken.issuer` field (#266)
 
 ### Changed
 - Split ID is deprecated, the first child part is used instead and is known to the other parts (#283)

diff --git a/acl/types.proto b/acl/types.proto
@@ -236,6 +236,10 @@ message BearerToken {
     }
     // Token expiration and valid time period parameters
     TokenLifetime lifetime = 3 [json_name="lifetime"];
+
+    // Token issuer's user ID in NeoFS. It must equal to the related
+    // container's owner.
+    neo.fs.v2.refs.OwnerID issuer = 4 [json_name="issuer"];
   }
   // Bearer Token body
   Body body = 1 [json_name="body"];

diff --git a/proto-docs/acl.md b/proto-docs/acl.md
@@ -60,6 +60,7 @@ owner with additional information preventing token abuse.
 | eacl_table | [EACLTable](#neo.fs.v2.acl.EACLTable) |  | Table of Extended ACL rules to use instead of the ones attached to the container. If it contains `container_id` field, bearer token is only valid for this specific container. Otherwise, any container of the same owner is allowed. |
 | owner_id | [neo.fs.v2.refs.OwnerID](#neo.fs.v2.refs.OwnerID) |  | `OwnerID` defines to whom the token was issued. It must match the request originator's `OwnerID`. If empty, any token bearer will be accepted. |
 | lifetime | [BearerToken.Body.TokenLifetime](#neo.fs.v2.acl.BearerToken.Body.TokenLifetime) |  | Token expiration and valid time period parameters |
+| issuer | [neo.fs.v2.refs.OwnerID](#neo.fs.v2.refs.OwnerID) |  | Token issuer's user ID in NeoFS. It must equal to the related container's owner. |
 
 
 <a name="neo.fs.v2.acl.BearerToken.Body.TokenLifetime"></a>