Skip to content

Container+EACL #369

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
cthulhu-rider wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Container+EACL #369

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions container/service.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,12 +136,37 @@ message PutRequest {
// creation by `Container` smart contract. `ContainerID` is a SHA256 hash of
// the stable-marshalled container strucutre, hence there is no need for
// additional signature checks.
//
// Optional `eacl` field allows to set extended access rules for the
// container. It must be either set or unset along with `eacl_signature`.
// `eacl_session_token` or `eacl_session_token_v1` must be set along with
// `eacl` only.
message Body {
// Container structure to register in NeoFS
container.Container container = 1;

// Signature of a stable-marshalled container according to RFC-6979.
neo.fs.v2.refs.SignatureRFC6979 signature = 2;

// Extended ACL for the container.
neo.fs.v2.acl.EACLTable eacl = 3;

// N3 witness of stable-marshalled `eacl` field. The witness must
// authenticate either container owner or one of subjects in
// the `eacl_session_token` field if any. Signature according to
// `ECDSA_RFC6979_SHA256` scheme is also supported.
neo.fs.v2.refs.SignatureRFC6979 eacl_signature = 4;

// Optional eACL session token. The token must be issued by the container
// owner. The token must have at least one subject authenticated
// by `eacl_signature` field. The token must have at least one context
// with this container and `CONTAINER_SETEACL` verb.
neo.fs.v2.session.SessionTokenV2 eacl_session_token = 5;

// Optional eACL session token (V1). It must not be set together with
// `eacl_session_token` field that is highly recommended to be used
// instead. Requirements are the same for both.
neo.fs.v2.session.SessionToken eacl_session_token_v1 = 6;
}
// Body of container put request message.
Body body = 1;
Expand Down
9 changes: 9 additions & 0 deletions proto-docs/container.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -526,11 +526,20 @@ creation by `Container` smart contract. `ContainerID` is a SHA256 hash of
the stable-marshalled container strucutre, hence there is no need for
additional signature checks.

Optional `eacl` field allows to set extended access rules for the
container. It must be either set or unset along with `eacl_signature`.
`eacl_session_token` or `eacl_session_token_v1` must be set along with
`eacl` only.


| Field | Type | Label | Description |
| ----- | ---- | ----- | ----------- |
| container | [Container](#neo.fs.v2.container.Container) | | Container structure to register in NeoFS |
| signature | [neo.fs.v2.refs.SignatureRFC6979](#neo.fs.v2.refs.SignatureRFC6979) | | Signature of a stable-marshalled container according to RFC-6979. |
| eacl | [neo.fs.v2.acl.EACLTable](#neo.fs.v2.acl.EACLTable) | | Extended ACL for the container. |
| eacl_signature | [neo.fs.v2.refs.SignatureRFC6979](#neo.fs.v2.refs.SignatureRFC6979) | | N3 witness of stable-marshalled `eacl` field. The witness must authenticate either container owner or one of subjects in the `eacl_session_token` field if any. Signature according to `ECDSA_RFC6979_SHA256` scheme is also supported. |
| eacl_session_token | [neo.fs.v2.session.SessionTokenV2](#neo.fs.v2.session.SessionTokenV2) | | Optional eACL session token. The token must be issued by the container owner. The token must have at least one subject authenticated by `eacl_signature` field. The token must have at least one context with this container and `CONTAINER_SETEACL` verb. |
| eacl_session_token_v1 | [neo.fs.v2.session.SessionToken](#neo.fs.v2.session.SessionToken) | | Optional eACL session token (V1). It must not be set together with `eacl_session_token` field that is highly recommended to be used instead. Requirements are the same for both. |


<a name="neo.fs.v2.container.PutResponse"></a>
Expand Down