StorageRequestAuthorizer { public void authorize(StorageRequest<?> request) throws AccessDeniedException { logger.atFine().log("authorizeStorageRequest(%s)", request); if (request instanceof Storage.Objects.List) { Storage.Objects.List listRequest = (Storage.Objects.List) request; authorizationHandler.handleListObjects( getGcsUri(listRequest.getBucket(), listRequest.getPrefix())); } else if (request instanceof Storage.Objects.Insert) { Storage.Objects.Insert insertRequest = (Storage.Objects.Insert) request; authorizationHandler.handleInsertObject( getGcsUri(insertRequest.getBucket(), ((StorageObject) getData(request)).getName())); } else if (request instanceof Storage.Objects.Compose) { Storage.Objects.Compose composeRequest = (Storage.Objects.Compose) request; String bucket = composeRequest.getDestinationBucket(); URI destination = getGcsUri(bucket, composeRequest.getDestinationObject()); List<URI> sources = ((ComposeRequest) getData(request)) .getSourceObjects().stream() .map(source -> getGcsUri(bucket, source.getName())) .collect(toImmutableList()); authorizationHandler.handleComposeObject(destination, sources); } else if (request instanceof Storage.Objects.Get) { Storage.Objects.Get getRequest = (Storage.Objects.Get) request; authorizationHandler.handleGetObject( getGcsUri(getRequest.getBucket(), getRequest.getObject())); } else if (request instanceof Storage.Objects.Delete) { Storage.Objects.Delete deleteRequest = (Storage.Objects.Delete) request; authorizationHandler.handleDeleteObject( getGcsUri(deleteRequest.getBucket(), deleteRequest.getObject())); } else if (request instanceof Storage.Objects.Rewrite) { Storage.Objects.Rewrite rewriteRequest = (Storage.Objects.Rewrite) request; authorizationHandler.handleRewriteObject( getGcsUri(rewriteRequest.getSourceBucket(), rewriteRequest.getSourceObject()), getGcsUri(rewriteRequest.getDestinationBucket(), rewriteRequest.getDestinationObject())); } else if (request instanceof Storage.Objects.Copy) { Storage.Objects.Copy copyRequest = (Storage.Objects.Copy) request; authorizationHandler.handleCopyObject( getGcsUri(copyRequest.getSourceBucket(), copyRequest.getSourceObject()), getGcsUri(copyRequest.getDestinationBucket(), copyRequest.getDestinationObject())); } else if (request instanceof Storage.Objects.Patch) { Storage.Objects.Patch patchRequest = (Storage.Objects.Patch) request; authorizationHandler.handlePatchObject( getGcsUri(patchRequest.getBucket(), patchRequest.getObject())); } else if (request instanceof Storage.Buckets.List) { authorizationHandler.handleListBuckets(((Storage.Buckets.List) request).getProject()); } else if (request instanceof Storage.Buckets.Insert) { authorizationHandler.handleInsertBucket( ((Storage.Buckets.Insert) request).getProject(), getGcsUri(((Bucket) getData(request)).getName(), null)); } else if (request instanceof Storage.Buckets.Get) { authorizationHandler.handleGetBucket( getGcsUri(((Storage.Buckets.Get) request).getBucket(), null)); } else if (request instanceof Storage.Buckets.Delete) { authorizationHandler.handleDeleteBucket( getGcsUri(((Storage.Buckets.Delete) request).getBucket(), null)); } else { throw new RuntimeException("Unhandled storage request type. Request: " + request); } } StorageRequestAuthorizer(
      Class<? extends AuthorizationHandler> handlerClass, Map<String, String> properties); @VisibleForTesting  StorageRequestAuthorizer(AuthorizationHandler authorizationHandler); void authorize(StorageRequest<?> request);  }
@Test public void testAuthorizationAllowed() throws Exception { Storage.Objects.List list = newStorage().objects().list(BUCKET_NAME).setPrefix(OBJECT_NAME); doNothing().when(mockHandler).handleListObjects(any(URI.class)); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(list); verify(mockHandler).handleListObjects(any(URI.class)); }
@Test public void testAccessDenied() throws Exception { Storage.Objects.List list = newStorage().objects().list(BUCKET_NAME).setPrefix(OBJECT_NAME); doThrow(AccessDeniedException.class).when(mockHandler).handleListObjects(any(URI.class)); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); assertThrows(AccessDeniedException.class, () -> authorizer.authorize(list)); }
@Test public void testListObject() throws Exception { Storage.Objects.List list = newStorage().objects().list(BUCKET_NAME).setPrefix(OBJECT_NAME); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(list); ArgumentCaptor<URI> captor = ArgumentCaptor.forClass(URI.class); verify(mockHandler).handleListObjects(captor.capture()); assertThat(captor.getValue().getAuthority()).isEqualTo(BUCKET_NAME); assertThat(captor.getValue().getPath()).isEqualTo(OBJECT_NAME); }
@Test public void testInsertObject() throws Exception { StorageObject object = new StorageObject().setName(OBJECT_NAME); Storage.Objects.Insert insert = newStorage().objects().insert(BUCKET_NAME, object); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(insert); ArgumentCaptor<URI> captor = ArgumentCaptor.forClass(URI.class); verify(mockHandler).handleInsertObject(captor.capture()); assertThat(captor.getValue().getAuthority()).isEqualTo(BUCKET_NAME); assertThat(captor.getValue().getPath()).isEqualTo(OBJECT_NAME); }
@Test public void testComposeObject() throws Exception { List<ComposeRequest.SourceObjects> sourceObjects = Stream.of(0, 1, 2) .map(x -> new ComposeRequest.SourceObjects().setName(OBJECT_NAME + "-" + x)) .collect(toImmutableList()); ComposeRequest request = new ComposeRequest().setSourceObjects(sourceObjects); Storage.Objects.Compose compose = newStorage().objects().compose(BUCKET_NAME, OBJECT_NAME, request); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(compose); ArgumentCaptor<URI> captor = ArgumentCaptor.forClass(URI.class); ArgumentCaptor<List<URI>> listCaptor = ArgumentCaptor.forClass(ArrayList.class); verify(mockHandler).handleComposeObject(captor.capture(), listCaptor.capture()); assertThat(captor.getValue().getAuthority()).isEqualTo(BUCKET_NAME); assertThat(captor.getValue().getPath()).isEqualTo(OBJECT_NAME); for (int i = 0; i < 3; ++i) { assertThat(listCaptor.getValue().get(i).getAuthority()).isEqualTo(BUCKET_NAME); assertThat(listCaptor.getValue().get(i).getPath()).isEqualTo(OBJECT_NAME + "-" + i); } }
@Test public void testGetObject() throws Exception { Storage.Objects.Get get = newStorage().objects().get(BUCKET_NAME, OBJECT_NAME); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(get); ArgumentCaptor<URI> captor = ArgumentCaptor.forClass(URI.class); verify(mockHandler).handleGetObject(captor.capture()); assertThat(captor.getValue().getAuthority()).isEqualTo(BUCKET_NAME); assertThat(captor.getValue().getPath()).isEqualTo(OBJECT_NAME); }
@Test public void testDeleteObject() throws Exception { Storage.Objects.Delete delete = newStorage().objects().delete(BUCKET_NAME, OBJECT_NAME); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(delete); ArgumentCaptor<URI> captor = ArgumentCaptor.forClass(URI.class); verify(mockHandler).handleDeleteObject(captor.capture()); assertThat(captor.getValue().getAuthority()).isEqualTo(BUCKET_NAME); assertThat(captor.getValue().getPath()).isEqualTo(OBJECT_NAME); }
@Test public void testRewriteObject() throws Exception { StorageObject object = new StorageObject().setName(OBJECT_NAME); Storage.Objects.Rewrite rewrite = newStorage() .objects() .rewrite(BUCKET_NAME, OBJECT_NAME, BUCKET_NAME_DST, OBJECT_NAME_DST, object); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(rewrite); ArgumentCaptor<URI> sourceCaptor = ArgumentCaptor.forClass(URI.class); ArgumentCaptor<URI> destinationCaptor = ArgumentCaptor.forClass(URI.class); verify(mockHandler).handleRewriteObject(sourceCaptor.capture(), destinationCaptor.capture()); assertThat(sourceCaptor.getValue().getAuthority()).isEqualTo(BUCKET_NAME); assertThat(sourceCaptor.getValue().getPath()).isEqualTo(OBJECT_NAME); assertThat(destinationCaptor.getValue().getAuthority()).isEqualTo(BUCKET_NAME_DST); assertThat(destinationCaptor.getValue().getPath()).isEqualTo(OBJECT_NAME_DST); }
@Test public void testCopyObject() throws Exception { StorageObject object = new StorageObject().setName(OBJECT_NAME); Storage.Objects.Copy copy = newStorage() .objects() .copy(BUCKET_NAME, OBJECT_NAME, BUCKET_NAME_DST, OBJECT_NAME_DST, object); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(copy); ArgumentCaptor<URI> sourceCaptor = ArgumentCaptor.forClass(URI.class); ArgumentCaptor<URI> destinationCaptor = ArgumentCaptor.forClass(URI.class); verify(mockHandler).handleCopyObject(sourceCaptor.capture(), destinationCaptor.capture()); assertThat(sourceCaptor.getValue().getAuthority()).isEqualTo(BUCKET_NAME); assertThat(sourceCaptor.getValue().getPath()).isEqualTo(OBJECT_NAME); assertThat(destinationCaptor.getValue().getAuthority()).isEqualTo(BUCKET_NAME_DST); assertThat(destinationCaptor.getValue().getPath()).isEqualTo(OBJECT_NAME_DST); }
@Test public void testPatchObject() throws Exception { StorageObject object = new StorageObject().setName(OBJECT_NAME); Storage.Objects.Patch patch = newStorage().objects().patch(BUCKET_NAME, OBJECT_NAME, object); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(patch); ArgumentCaptor<URI> captor = ArgumentCaptor.forClass(URI.class); verify(mockHandler).handlePatchObject(captor.capture()); assertThat(captor.getValue().getAuthority()).isEqualTo(BUCKET_NAME); assertThat(captor.getValue().getPath()).isEqualTo(OBJECT_NAME); }
@Test public void testListBucket() throws Exception { Storage.Buckets.List list = newStorage().buckets().list(PROJECT); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(list); verify(mockHandler).handleListBuckets(eq(PROJECT)); }
@Test public void testInsertBucket() throws Exception { Bucket bucket = new Bucket().setName(BUCKET_NAME); Storage.Buckets.Insert insert = newStorage().buckets().insert(BUCKET_NAME, bucket).setProject(PROJECT); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(insert); ArgumentCaptor<String> projectCaptor = ArgumentCaptor.forClass(String.class); ArgumentCaptor<URI> captor = ArgumentCaptor.forClass(URI.class); verify(mockHandler).handleInsertBucket(projectCaptor.capture(), captor.capture()); assertThat(projectCaptor.getValue()).isEqualTo(PROJECT); assertThat(captor.getValue().getAuthority()).isEqualTo(BUCKET_NAME); assertThat(captor.getValue().getPath()).isEqualTo("/"); }
@Test public void testGetBucket() throws Exception { Storage.Buckets.Get get = newStorage().buckets().get(BUCKET_NAME); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(get); ArgumentCaptor<URI> captor = ArgumentCaptor.forClass(URI.class); verify(mockHandler).handleGetBucket(captor.capture()); assertThat(captor.getValue().getAuthority()).isEqualTo(BUCKET_NAME); assertThat(captor.getValue().getPath()).isEqualTo("/"); }
@Test public void testDeleteBucket() throws Exception { Storage.Buckets.Delete delete = newStorage().buckets().delete(BUCKET_NAME); StorageRequestAuthorizer authorizer = new StorageRequestAuthorizer(mockHandler); authorizer.authorize(delete); ArgumentCaptor<URI> captor = ArgumentCaptor.forClass(URI.class); verify(mockHandler).handleDeleteBucket(captor.capture()); assertThat(captor.getValue().getAuthority()).isEqualTo(BUCKET_NAME); assertThat(captor.getValue().getPath()).isEqualTo("/"); }