Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support new operators in eACL rules #286

Merged
merged 2 commits into from
Feb 5, 2024
Merged

Support new operators in eACL rules #286

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5c8514d
acl: Support access rules for absent attributes
cthulhu-rider Feb 2, 2024
541cd3c
object: Support numeric comparisons in access rules
cthulhu-rider Feb 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 24 additions & 1 deletion acl/types.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,21 @@ enum MatchType {

// Return true if strings are different
STRING_NOT_EQUAL = 2;

// Absence of attribute
NOT_PRESENT = 3;

// Numeric 'greater than'
NUM_GT = 4;

// Numeric 'greater or equal than'
NUM_GE = 5;

// Numeric 'less than'
NUM_LT = 6;

// Numeric 'less or equal than'
NUM_LE = 7;
}

// Request's operation type to match if the rule is applicable to a particular
Expand Down Expand Up @@ -102,9 +117,14 @@ message EACLRecord {

// Filter to check particular properties of the request or the object.
//
// The `value` field must be empty if `match_type` is an unary operator
// (e.g. `NOT_PRESENT`). If `match_type` field is numeric (e.g. `NUM_GT`),
// the `value` field must be a base-10 integer.
//
// By default `key` field refers to the corresponding object's `Attribute`.
// Some Object's header fields can also be accessed by adding `$Object:`
// prefix to the name. Here is the list of fields available via this prefix:
// prefix to the name. For such attributes, field 'match_type' must not be
// 'NOT_PRESENT'. Here is the list of fields available via this prefix:
//
// * $Object:version \
// version
Expand All @@ -125,6 +145,9 @@ message EACLRecord {
// * $Object:homomorphicHash \
// homomorphic_hash
//
// Numeric `match_type` field can only be used with `$Object:creationEpoch`
// and `$Object:payloadLength` system attributes.
//
// Please note, that if request or response does not have object's headers of
// full object (Range, RangeHash, Search, Delete), it will not be possible to
// filter by object header fields or user attributes. From the well-known list
Expand Down
15 changes: 14 additions & 1 deletion proto-docs/acl.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,9 +95,14 @@ Describes a single eACL rule.
### Message EACLRecord.Filter
Filter to check particular properties of the request or the object.

The `value` field must be empty if `match_type` is an unary operator
(e.g. `NOT_PRESENT`). If `match_type` field is numeric (e.g. `NUM_GT`),
the `value` field must be a base-10 integer.

By default `key` field refers to the corresponding object's `Attribute`.
Some Object's header fields can also be accessed by adding `$Object:`
prefix to the name. Here is the list of fields available via this prefix:
prefix to the name. For such attributes, field 'match_type' must not be
'NOT_PRESENT'. Here is the list of fields available via this prefix:

* $Object:version \
version
Expand All @@ -118,6 +123,9 @@ prefix to the name. Here is the list of fields available via this prefix:
* $Object:homomorphicHash \
homomorphic_hash

Numeric `match_type` field can only be used with `$Object:creationEpoch`
and `$Object:payloadLength` system attributes.

Please note, that if request or response does not have object's headers of
full object (Range, RangeHash, Search, Delete), it will not be possible to
filter by object header fields or user attributes. From the well-known list
Expand Down Expand Up @@ -202,6 +210,11 @@ MatchType is an enumeration of match types.
| MATCH_TYPE_UNSPECIFIED | 0 | Unspecified match type, default value. |
| STRING_EQUAL | 1 | Return true if strings are equal |
| STRING_NOT_EQUAL | 2 | Return true if strings are different |
| NOT_PRESENT | 3 | Absence of attribute |
| NUM_GT | 4 | Numeric 'greater than' |
| NUM_GE | 5 | Numeric 'greater or equal than' |
| NUM_LT | 6 | Numeric 'less than' |
| NUM_LE | 7 | Numeric 'less or equal than' |



Expand Down
Loading