@@ -18,9 +18,13 @@ const apiMethodWithVersion = {
1818} ;
1919
2020function isHeaderAcl ( headers ) {
21- return headers [ 'x-amz-grant-read' ] || headers [ 'x-amz-grant-read-acp' ] ||
22- headers [ 'x-amz-grant-write-acp' ] || headers [ 'x-amz-grant-full-control' ] ||
23- headers [ 'x-amz-acl' ] ;
21+ return (
22+ headers [ 'x-amz-grant-read' ] ||
23+ headers [ 'x-amz-grant-read-acp' ] ||
24+ headers [ 'x-amz-grant-write-acp' ] ||
25+ headers [ 'x-amz-grant-full-control' ] ||
26+ headers [ 'x-amz-acl' ]
27+ ) ;
2428}
2529
2630/**
@@ -32,8 +36,7 @@ function isHeaderAcl(headers) {
3236 * @param {string } sourceVersionId - value of sourceVersionId if copy request
3337 * @return {RequestContext [] } array of requestContexts
3438 */
35- function prepareRequestContexts ( apiMethod , request , sourceBucket ,
36- sourceObject , sourceVersionId ) {
39+ function prepareRequestContexts ( apiMethod , request , sourceBucket , sourceObject , sourceVersionId ) {
3740 // if multiObjectDelete request, we want to authenticate
3841 // before parsing the post body and creating multiple requestContexts
3942 // so send null as requestContexts to Vault to avoid authorization
@@ -48,17 +51,23 @@ function prepareRequestContexts(apiMethod, request, sourceBucket,
4851 const isSecure = requestUtils . getHttpProtocolSecurity ( request , config ) ;
4952
5053 function generateRequestContext ( apiMethod ) {
51- return new RequestContext ( request . headers ,
52- request . query , request . bucketName , request . objectKey ,
53- ip , isSecure , apiMethod , 's3' ) ;
54+ return new RequestContext (
55+ request . headers ,
56+ request . query ,
57+ request . bucketName ,
58+ request . objectKey ,
59+ ip ,
60+ isSecure ,
61+ apiMethod ,
62+ 's3' ,
63+ ) ;
5464 }
5565
5666 if ( apiMethod === 'bucketPut' ) {
5767 return null ;
5868 }
5969
60- if ( apiMethodWithVersion [ apiMethod ] && request . query &&
61- request . query . versionId ) {
70+ if ( apiMethodWithVersion [ apiMethod ] && request . query && request . query . versionId ) {
6271 apiMethodAfterVersionCheck = `${ apiMethod } Version` ;
6372 } else {
6473 apiMethodAfterVersionCheck = apiMethod ;
@@ -75,184 +84,155 @@ function prepareRequestContexts(apiMethod, request, sourceBucket,
7584 // In the API, we then ignore these authorization results, and we can use
7685 // any information returned, e.g., the quota.
7786 const requestContextMultiObjectDelete = generateRequestContext ( 'objectDelete' ) ;
78- requestContexts . push ( requestContextMultiObjectDelete ) ;
79- } else if ( apiMethodAfterVersionCheck === 'objectCopy'
80- || apiMethodAfterVersionCheck === 'objectPutCopyPart' ) {
81- const objectGetAction = sourceVersionId ? 'objectGetVersion' :
82- 'objectGet' ;
83- const reqQuery = Object . assign ( { } , request . query ,
84- { versionId : sourceVersionId } ) ;
85- const getRequestContext = new RequestContext ( request . headers ,
86- reqQuery , sourceBucket , sourceObject ,
87- ip , isSecure ,
88- objectGetAction , 's3' ) ;
87+ requestContexts . push ( requestContextMultiObjectDelete ) ;
88+ } else if ( apiMethodAfterVersionCheck === 'objectCopy' || apiMethodAfterVersionCheck === 'objectPutCopyPart' ) {
89+ const objectGetAction = sourceVersionId ? 'objectGetVersion' : 'objectGet' ;
90+ const reqQuery = Object . assign ( { } , request . query , { versionId : sourceVersionId } ) ;
91+ const getRequestContext = new RequestContext (
92+ request . headers ,
93+ reqQuery ,
94+ sourceBucket ,
95+ sourceObject ,
96+ ip ,
97+ isSecure ,
98+ objectGetAction ,
99+ 's3' ,
100+ ) ;
89101 // Same API method as the one checked on the destination by the API
90- const objectPutAction = apiMethodAfterVersionCheck === 'objectPutCopyPart' ? 'objectPutPart' :
91- 'objectPut' ;
102+ const objectPutAction = apiMethodAfterVersionCheck === 'objectPutCopyPart' ? 'objectPutPart' : 'objectPut' ;
92103 const putRequestContext = generateRequestContext ( objectPutAction ) ;
93104 requestContexts . push ( getRequestContext , putRequestContext ) ;
94105 if ( apiMethodAfterVersionCheck === 'objectCopy' ) {
95106 // if tagging directive is COPY, "s3:PutObjectTagging" don't need
96107 // to be included in the list of permitted actions in IAM policy
97- if ( request . headers [ 'x-amz-tagging' ] &&
98- request . headers [ 'x-amz-tagging-directive' ] === 'REPLACE' ) {
99- const putTaggingRequestContext =
100- generateRequestContext ( 'objectPutTagging' ) ;
108+ if ( request . headers [ 'x-amz-tagging' ] && request . headers [ 'x-amz-tagging-directive' ] === 'REPLACE' ) {
109+ const putTaggingRequestContext = generateRequestContext ( 'objectPutTagging' ) ;
101110 requestContexts . push ( putTaggingRequestContext ) ;
102111 }
103112 if ( isHeaderAcl ( request . headers ) ) {
104- const putAclRequestContext =
105- generateRequestContext ( 'objectPutACL' ) ;
113+ const putAclRequestContext = generateRequestContext ( 'objectPutACL' ) ;
106114 requestContexts . push ( putAclRequestContext ) ;
107115 }
108116 }
109- } else if ( apiMethodAfterVersionCheck === 'objectGet'
110- || apiMethodAfterVersionCheck === 'objectGetVersion' ) {
111- const objectGetTaggingAction = ( request . query &&
112- request . query . versionId ) ? 'objectGetTaggingVersion' :
113- 'objectGetTagging' ;
117+ } else if ( apiMethodAfterVersionCheck === 'objectGet' || apiMethodAfterVersionCheck === 'objectGetVersion' ) {
118+ const objectGetTaggingAction =
119+ request . query && request . query . versionId ? 'objectGetTaggingVersion' : 'objectGetTagging' ;
114120 if ( request . headers [ 'x-amz-version-id' ] ) {
115121 const objectGetVersionAction = 'objectGetVersion' ;
116- const getVersionResourceVersion =
117- generateRequestContext ( objectGetVersionAction ) ;
122+ const getVersionResourceVersion = generateRequestContext ( objectGetVersionAction ) ;
118123 requestContexts . push ( getVersionResourceVersion ) ;
119124 }
120- const getRequestContext =
121- generateRequestContext ( apiMethodAfterVersionCheck ) ;
122- const getTaggingRequestContext =
123- generateRequestContext ( objectGetTaggingAction ) ;
125+ const getRequestContext = generateRequestContext ( apiMethodAfterVersionCheck ) ;
126+ const getTaggingRequestContext = generateRequestContext ( objectGetTaggingAction ) ;
124127 requestContexts . push ( getRequestContext , getTaggingRequestContext ) ;
125128 } else if ( apiMethodAfterVersionCheck === 'objectGetTagging' ) {
126129 const objectGetTaggingAction = 'objectGetTagging' ;
127- const getTaggingResourceVersion =
128- generateRequestContext ( objectGetTaggingAction ) ;
130+ const getTaggingResourceVersion = generateRequestContext ( objectGetTaggingAction ) ;
129131 requestContexts . push ( getTaggingResourceVersion ) ;
130132 if ( request . headers [ 'x-amz-version-id' ] ) {
131133 const objectGetTaggingVersionAction = 'objectGetTaggingVersion' ;
132- const getTaggingVersionResourceVersion =
133- generateRequestContext ( objectGetTaggingVersionAction ) ;
134+ const getTaggingVersionResourceVersion = generateRequestContext ( objectGetTaggingVersionAction ) ;
134135 requestContexts . push ( getTaggingVersionResourceVersion ) ;
135136 }
136137 } else if ( apiMethodAfterVersionCheck === 'objectHead' ) {
137138 const objectHeadAction = 'objectHead' ;
138- const headObjectAction =
139- generateRequestContext ( objectHeadAction ) ;
139+ const headObjectAction = generateRequestContext ( objectHeadAction ) ;
140140 requestContexts . push ( headObjectAction ) ;
141141 if ( request . headers [ 'x-amz-version-id' ] ) {
142142 const objectHeadVersionAction = 'objectGetVersion' ;
143- const headObjectVersion =
144- generateRequestContext ( objectHeadVersionAction ) ;
143+ const headObjectVersion = generateRequestContext ( objectHeadVersionAction ) ;
145144 requestContexts . push ( headObjectVersion ) ;
146145 }
147146 if ( request . headers [ 'x-amz-scal-archive-info' ] ) {
148- const coldStatus =
149- generateRequestContext ( 'objectGetArchiveInfo' ) ;
147+ const coldStatus = generateRequestContext ( 'objectGetArchiveInfo' ) ;
150148 requestContexts . push ( coldStatus ) ;
151149 }
152150 } else if ( apiMethodAfterVersionCheck === 'objectPutTagging' ) {
153- const putObjectTaggingRequestContext =
154- generateRequestContext ( 'objectPutTagging' ) ;
151+ const putObjectTaggingRequestContext = generateRequestContext ( 'objectPutTagging' ) ;
155152 requestContexts . push ( putObjectTaggingRequestContext ) ;
156153 if ( request . headers [ 'x-amz-version-id' ] ) {
157- const putObjectVersionRequestContext =
158- generateRequestContext ( 'objectPutTaggingVersion' ) ;
154+ const putObjectVersionRequestContext = generateRequestContext ( 'objectPutTaggingVersion' ) ;
159155 requestContexts . push ( putObjectVersionRequestContext ) ;
160156 }
161157 } else if ( apiMethodAfterVersionCheck === 'objectPut' ) {
162158 // if put object with version
163- if ( request . headers [ 'x-scal-s3-version-id' ] ||
164- request . headers [ 'x-scal-s3-version-id' ] === '' ) {
165- const putVersionRequestContext =
166- generateRequestContext ( 'objectPutVersion' ) ;
159+ if ( request . headers [ 'x-scal-s3-version-id' ] || request . headers [ 'x-scal-s3-version-id' ] === '' ) {
160+ const putVersionRequestContext = generateRequestContext ( 'objectPutVersion' ) ;
167161 requestContexts . push ( putVersionRequestContext ) ;
168162 } else {
169- const putRequestContext =
170- generateRequestContext ( apiMethodAfterVersionCheck ) ;
163+ const putRequestContext = generateRequestContext ( apiMethodAfterVersionCheck ) ;
171164 requestContexts . push ( putRequestContext ) ;
172165 // if put object (versioning) with tag set
173166 if ( request . headers [ 'x-amz-tagging' ] ) {
174- const putTaggingRequestContext =
175- generateRequestContext ( 'objectPutTagging' ) ;
167+ const putTaggingRequestContext = generateRequestContext ( 'objectPutTagging' ) ;
176168 requestContexts . push ( putTaggingRequestContext ) ;
177169 }
178170 if ( [ 'ON' , 'OFF' ] . includes ( request . headers [ 'x-amz-object-lock-legal-hold-status' ] ) ) {
179- const putLegalHoldStatusAction =
180- generateRequestContext ( 'objectPutLegalHold' ) ;
171+ const putLegalHoldStatusAction = generateRequestContext ( 'objectPutLegalHold' ) ;
181172 requestContexts . push ( putLegalHoldStatusAction ) ;
182173 }
183174 // if put object (versioning) with ACL
184175 if ( isHeaderAcl ( request . headers ) ) {
185- const putAclRequestContext =
186- generateRequestContext ( 'objectPutACL' ) ;
176+ const putAclRequestContext = generateRequestContext ( 'objectPutACL' ) ;
187177 requestContexts . push ( putAclRequestContext ) ;
188178 }
189179 if ( request . headers [ 'x-amz-object-lock-mode' ] ) {
190- const putObjectLockRequestContext =
191- generateRequestContext ( 'objectPutRetention' ) ;
180+ const putObjectLockRequestContext = generateRequestContext ( 'objectPutRetention' ) ;
192181 requestContexts . push ( putObjectLockRequestContext ) ;
193182 if ( hasGovernanceBypassHeader ( request . headers ) ) {
194- const checkUserGovernanceBypassRequestContext =
195- generateRequestContext ( 'bypassGovernanceRetention' ) ;
183+ const checkUserGovernanceBypassRequestContext = generateRequestContext ( 'bypassGovernanceRetention' ) ;
196184 requestContexts . push ( checkUserGovernanceBypassRequestContext ) ;
197185 }
198186 }
199187 if ( request . headers [ 'x-amz-version-id' ] ) {
200- const putObjectVersionRequestContext =
201- generateRequestContext ( 'objectPutTaggingVersion' ) ;
188+ const putObjectVersionRequestContext = generateRequestContext ( 'objectPutTaggingVersion' ) ;
202189 requestContexts . push ( putObjectVersionRequestContext ) ;
203190 }
204191 }
205- } else if ( apiMethodAfterVersionCheck === 'objectPutRetention' ||
206- apiMethodAfterVersionCheck === 'objectPutRetentionVersion' ) {
207- const putRetentionRequestContext =
208- generateRequestContext ( apiMethodAfterVersionCheck ) ;
192+ } else if (
193+ apiMethodAfterVersionCheck === 'objectPutRetention' ||
194+ apiMethodAfterVersionCheck === 'objectPutRetentionVersion'
195+ ) {
196+ const putRetentionRequestContext = generateRequestContext ( apiMethodAfterVersionCheck ) ;
209197 requestContexts . push ( putRetentionRequestContext ) ;
210198 if ( hasGovernanceBypassHeader ( request . headers ) ) {
211- const checkUserGovernanceBypassRequestContext =
212- generateRequestContext ( 'bypassGovernanceRetention' ) ;
199+ const checkUserGovernanceBypassRequestContext = generateRequestContext ( 'bypassGovernanceRetention' ) ;
213200 requestContexts . push ( checkUserGovernanceBypassRequestContext ) ;
214201 }
215- } else if ( apiMethodAfterVersionCheck === 'initiateMultipartUpload' ||
216- apiMethodAfterVersionCheck === 'objectPutPart' ||
217- apiMethodAfterVersionCheck === 'completeMultipartUpload'
218- ) {
219- if ( request . headers [ 'x-scal-s3-version-id' ] ||
220- request . headers [ 'x-scal-s3-version-id' ] === '' ) {
221- const putVersionRequestContext =
222- generateRequestContext ( 'objectPutVersion' ) ;
202+ } else if (
203+ apiMethodAfterVersionCheck === 'initiateMultipartUpload' ||
204+ apiMethodAfterVersionCheck === 'objectPutPart' ||
205+ apiMethodAfterVersionCheck === 'completeMultipartUpload'
206+ ) {
207+ if ( request . headers [ 'x-scal-s3-version-id' ] || request . headers [ 'x-scal-s3-version-id' ] === '' ) {
208+ const putVersionRequestContext = generateRequestContext ( 'objectPutVersion' ) ;
223209 requestContexts . push ( putVersionRequestContext ) ;
224210 } else {
225- const putRequestContext =
226- generateRequestContext ( apiMethodAfterVersionCheck ) ;
211+ const putRequestContext = generateRequestContext ( apiMethodAfterVersionCheck ) ;
227212 requestContexts . push ( putRequestContext ) ;
228213 }
229214
230215 // if put object (versioning) with ACL
231216 if ( isHeaderAcl ( request . headers ) ) {
232- const putAclRequestContext =
233- generateRequestContext ( 'objectPutACL' ) ;
217+ const putAclRequestContext = generateRequestContext ( 'objectPutACL' ) ;
234218 requestContexts . push ( putAclRequestContext ) ;
235219 }
236220
237221 if ( request . headers [ 'x-amz-object-lock-mode' ] ) {
238- const putObjectLockRequestContext =
239- generateRequestContext ( 'objectPutRetention' ) ;
222+ const putObjectLockRequestContext = generateRequestContext ( 'objectPutRetention' ) ;
240223 requestContexts . push ( putObjectLockRequestContext ) ;
241224 }
242225 if ( request . headers [ 'x-amz-version-id' ] ) {
243- const putObjectVersionRequestContext =
244- generateRequestContext ( 'objectPutTaggingVersion' ) ;
226+ const putObjectVersionRequestContext = generateRequestContext ( 'objectPutTaggingVersion' ) ;
245227 requestContexts . push ( putObjectVersionRequestContext ) ;
246228 }
247- // AWS only returns an object lock error if a version id
248- // is specified, else continue to create a delete marker
229+ // AWS only returns an object lock error if a version id
230+ // is specified, else continue to create a delete marker
249231 } else if ( sourceVersionId && apiMethodAfterVersionCheck === 'objectDeleteVersion' ) {
250- const deleteRequestContext =
251- generateRequestContext ( apiMethodAfterVersionCheck ) ;
232+ const deleteRequestContext = generateRequestContext ( apiMethodAfterVersionCheck ) ;
252233 requestContexts . push ( deleteRequestContext ) ;
253234 if ( hasGovernanceBypassHeader ( request . headers ) ) {
254- const checkUserGovernanceBypassRequestContext =
255- generateRequestContext ( 'bypassGovernanceRetention' ) ;
235+ const checkUserGovernanceBypassRequestContext = generateRequestContext ( 'bypassGovernanceRetention' ) ;
256236 requestContexts . push ( checkUserGovernanceBypassRequestContext ) ;
257237 }
258238 } else if ( apiMethodAfterVersionCheck === 'bucketGet' ) {
@@ -271,19 +251,15 @@ function prepareRequestContexts(apiMethod, request, sourceBucket,
271251 generateRequestContext ( 'objectGetVersionAttributes' ) ,
272252 ) ;
273253 } else {
274- requestContexts . push (
275- generateRequestContext ( 'objectGet' ) ,
276- generateRequestContext ( 'objectGetAttributes' ) ,
277- ) ;
254+ requestContexts . push ( generateRequestContext ( 'objectGet' ) , generateRequestContext ( 'objectGetAttributes' ) ) ;
278255 }
279256
280257 const attributes = request . headers [ 'x-amz-object-attributes' ] ?. split ( ',' ) ?? [ ] ;
281258 if ( attributes . some ( attr => attr . trim ( ) . toLowerCase ( ) . startsWith ( 'x-amz-meta-' ) ) ) {
282259 requestContexts . push ( generateRequestContext ( 'objectGetAttributesCustom' ) ) ;
283260 }
284261 } else {
285- const requestContext =
286- generateRequestContext ( apiMethodAfterVersionCheck ) ;
262+ const requestContext = generateRequestContext ( apiMethodAfterVersionCheck ) ;
287263 requestContexts . push ( requestContext ) ;
288264 }
289265
0 commit comments