Merge remote-tracking branch 'origin/bugfix/CLDSRV-1040-part-copy-destination-authorization' into w/9.4/bugfix/CLDSRV-1040-part-copy-destination-authorization

# Conflicts:
#	lib/api/apiUtils/authorization/prepareRequestContexts.js
#	tests/unit/api/apiUtils/authorization/prepareRequestContexts.js
#	tests/unit/api/objectCopyPart.js

Author: tcarmet

lib/api/apiUtils/authorization/prepareRequestContexts.js

@@ -98,7 +98,9 @@ function prepareRequestContexts(apiMethod, request, sourceBucket, sourceObject,
             objectGetAction,
             's3',
         );
-        const putRequestContext = generateRequestContext('objectPut');
+        // Same API method as the one checked on the destination by the API
+        const objectPutAction = apiMethodAfterVersionCheck === 'objectPutCopyPart' ? 'objectPutPart' : 'objectPut';
+        const putRequestContext = generateRequestContext(objectPutAction);
         requestContexts.push(getRequestContext, putRequestContext);
         if (apiMethodAfterVersionCheck === 'objectCopy') {
             // if tagging directive is COPY, "s3:PutObjectTagging" don't need

tests/unit/api/apiUtils/authorization/prepareRequestContexts.js

@@ -42,8 +42,8 @@ describe('prepareRequestContexts', () => {
     );
 
     it(
-        'should return s3:PutObjectVersion request context action for objectPut method with empty x-scal-s3-version-id' +
-            ' header',
+        'should return s3:PutObjectVersion request context action for objectPut method' +
+            ' with empty x-scal-s3-version-id header',
         () => {
             const apiMethod = 'objectPut';
             const request = makeRequest({
@@ -154,6 +154,38 @@ describe('prepareRequestContexts', () => {
         },
     );
 
+    // The API checks the authorization results by API method, so the request
+    // contexts must carry the API methods it checks, not only the right actions
+    [
+        { apiMethod: 'objectCopy', destApiMethod: 'objectPut' },
+        { apiMethod: 'objectPutCopyPart', destApiMethod: 'objectPutPart' },
+    ].forEach(({ apiMethod, destApiMethod }) => {
+        it(`should authorize the destination of ${apiMethod} as ${destApiMethod}`, () => {
+            const request = makeRequest({});
+            const results = prepareRequestContexts(apiMethod, request, sourceBucket, sourceObject);
+
+            assert.deepStrictEqual(
+                results.map(rc => rc._apiMethod),
+                ['objectGet', destApiMethod],
+            );
+            assert.deepStrictEqual(
+                results.map(rc => rc.getAction()),
+                ['s3:GetObject', 's3:PutObject'],
+            );
+        });
+
+        it(`should authorize a specific source version of ${apiMethod} as objectGetVersion`, () => {
+            const request = makeRequest({});
+            const results = prepareRequestContexts(apiMethod, request, sourceBucket, sourceObject, sourceVersionId);
+
+            assert.deepStrictEqual(
+                results.map(rc => rc._apiMethod),
+                ['objectGetVersion', destApiMethod],
+            );
+            assert.strictEqual(results[0].getQuery().versionId, sourceVersionId);
+        });
+    });
+
     it('should return s3:PutObjectRetention with header x-amz-object-lock-mode', () => {
         const apiMethod = 'objectPut';
         const request = makeRequest({

tests/unit/api/objectCopyPart.js

@@ -2,7 +2,8 @@ const assert = require('assert');
 const async = require('async');
 const sinon = require('sinon');
 const { parseString } = require('xml2js');
-const { storage } = require('arsenal');
+const { auth, storage } = require('arsenal');
+const api = require('../../../lib/api/api');
 const { bucketPut } = require('../../../lib/api/bucketPut');
 const objectPut = require('../../../lib/api/objectPut');
 const objectPutCopyPart = require('../../../lib/api/objectPutCopyPart');
@@ -564,3 +565,105 @@ describe('objectPutCopyPart with checksums disabled', () => {
         });
     });
 });
+
+describe('objectCopyPart through api.callApiMethod', () => {
+    const userAuthInfo = makeAuthInfo(canonicalID, 'user');
+    const objData = Buffer.from('foo', 'utf8');
+    const sandbox = sinon.createSandbox();
+    let uploadId;
+
+    // Vault returns one result per request context, keyed by its API method
+    function stubDoAuth(deniedAction) {
+        sandbox.stub(auth, 'server').value({
+            doAuth: (req, reqLog, cb, awsService, requestContexts) =>
+                cb(
+                    null,
+                    userAuthInfo,
+                    requestContexts.map(rc => {
+                        const denied = rc.getAction() === deniedAction;
+                        return { isAllowed: !denied, isImplicit: denied, action: rc._apiMethod };
+                    }),
+                ),
+        });
+    }
+
+    function _createCopyPartApiRequest() {
+        return new DummyRequest({
+            bucketName: destBucketName,
+            namespace,
+            objectKey,
+            headers: {
+                host: `${destBucketName}.s3.amazonaws.com`,
+                'x-amz-copy-source': `${sourceBucketName}/${objectKey}`,
+            },
+            url: `/${objectKey}?partNumber=1&uploadId=${uploadId}`,
+            query: {
+                partNumber: '1',
+                uploadId,
+            },
+        });
+    }
+
+    before(done => {
+        cleanup();
+        async.waterfall(
+            [
+                callback => bucketPut(authInfo, _createBucketPutRequest(destBucketName), log, err => callback(err)),
+                callback => bucketPut(authInfo, _createBucketPutRequest(sourceBucketName), log, err => callback(err)),
+                callback =>
+                    objectPut(
+                        authInfo,
+                        versioningTestUtils.createPutObjectRequest(sourceBucketName, objectKey, objData),
+                        undefined,
+                        log,
+                        err => callback(err),
+                    ),
+                callback =>
+                    objectPut(
+                        authInfo,
+                        versioningTestUtils.createPutObjectRequest(destBucketName, objectKey, objData),
+                        undefined,
+                        log,
+                        err => callback(err),
+                    ),
+                callback =>
+                    initiateMultipartUpload(userAuthInfo, _createInitiateRequest(destBucketName), log, (err, res) =>
+                        callback(err, res),
+                    ),
+            ],
+            (err, res) => {
+                if (err) {
+                    return done(err);
+                }
+                return parseString(res, (err, json) => {
+                    uploadId = json.InitiateMultipartUploadResult.UploadId[0];
+                    return done(err);
+                });
+            },
+        );
+    });
+
+    afterEach(() => {
+        sandbox.restore();
+    });
+
+    after(() => {
+        cleanup();
+    });
+
+    it('should copy the part when IAM allows every action', done => {
+        stubDoAuth(null);
+        api.callApiMethod('objectPutCopyPart', _createCopyPartApiRequest(), {}, log, err => {
+            assert.ifError(err);
+            done();
+        });
+    });
+
+    it('should deny the copy into an existing key when IAM denies s3:PutObject', done => {
+        stubDoAuth('s3:PutObject');
+        api.callApiMethod('objectPutCopyPart', _createCopyPartApiRequest(), {}, log, err => {
+            assert(err && err.is.AccessDenied, `expected AccessDenied, got ${err}`);
+            done();
+        });
+    });
+});