Session token V2 #3671

End-rey · 2025-11-07T20:34:20Z

Refs nspcc-dev/neofs-api#350, nspcc-dev/neofs-sdk-go#750

codecov · 2025-11-07T21:00:52Z

Codecov Report

❌ Patch coverage is 24.29501% with 349 lines in your changes missing coverage. Please review.
✅ Project coverage is 25.55%. Comparing base (8677303) to head (9a6fcc8).

Files with missing lines	Patch %	Lines
pkg/services/object/acl/v2/service.go	16.12%	101 Missing and 3 partials ⚠️
pkg/services/container/server.go	51.61%	43 Missing and 17 partials ⚠️
pkg/innerring/processors/container/common.go	0.00%	33 Missing ⚠️
cmd/neofs-cli/modules/object/util.go	0.00%	29 Missing ⚠️
pkg/services/object/util/prm.go	0.00%	19 Missing ⚠️
pkg/services/object/get/util.go	0.00%	15 Missing ⚠️
pkg/core/object/fmt.go	33.33%	11 Missing and 1 partial ⚠️
internal/crypto/object.go	23.07%	9 Missing and 1 partial ⚠️
internal/chaintime/chaintime.go	0.00%	8 Missing ⚠️
cmd/neofs-node/container.go	0.00%	7 Missing ⚠️
... and 16 more

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3671      +/-   ##
==========================================
- Coverage   25.60%   25.55%   -0.06%     
==========================================
  Files         657      658       +1     
  Lines       42097    42468     +371     
==========================================
+ Hits        10780    10852      +72     
- Misses      30338    30613     +275     
- Partials      979     1003      +24

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Part of #3671.

carpawell · 2025-12-30T17:54:15Z

pkg/services/container/server.go

+type nnsResolver struct {
+	fsChain FSChain
+
+	nnsCache *lru.Cache[string, bool]


nns checks never expire (if size is big enough)?

Reset cache with the (s *Server) ResetSessionTokenCheckCache().

pkg/services/container/server.go

pkg/services/container/server_test.go

pkg/services/object/put/service_test.go

pkg/services/object/acl/v2/service.go

CHANGELOG.md

roman-khimov · 2026-01-13T20:20:35Z

cmd/neofs-cli/modules/object/util.go

-		verb = sessionv2.VerbObjectDelete
+		// For DELETE, create context with two verbs:
+		// 1. DELETE for the deleted object
+		// 2. PUT for the tombstone


Shouldn't be required, tombstone PUT is DELETE ACL-wise.

For me, using Put without objects is more logical for verification than Delete with an object tombstone whose ID we don't know yet.

neofs-node/pkg/services/object/acl/v2/service.go

Lines 638 to 646 in 3f6a367

op, verb, verbv2 := acl.OpObjectPut, sessionSDK.VerbObjectPut, sessionSDKv2.VerbObjectPut

tombstone := header.GetObjectType() == protoobject.ObjectType_TOMBSTONE

if tombstone {

// such objects are specific - saving them is essentially the removal of other

// objects

op, verb = acl.OpObjectDelete, sessionSDK.VerbObjectDelete

}

reqInfo, err := b.findRequestInfo(request, cnr, op, verb, verbv2, obj)

If I check Delete without objects here, it will be a bad check for the initial request with the object that needs to be deleted. There is no need to check Put with an object, because the ID is usually generated after the token is signed.

neofs-node/pkg/services/object/acl/v2/service.go

Lines 375 to 382 in 3f6a367

// When we PUT a tombstone, the requested object is not zero,

// but the session is not bound to it because the user cannot predict its ID.

if !reqObj.IsZero() && reqVerb != sessionSDKv2.VerbObjectPut {

if !token.AssertObject(reqVerb, reqCnr, reqObj) {

return errors.New("v2 session token does not authorize access to the object")

}

} else {

if !token.AssertVerb(reqVerb, reqCnr) {

The meaning of OID for DELETE is to represent deleted OID.

It seems strange and incorrect to me when the request changes from PUT for the tombstone to DELETE with the OID of the tombstone itself. In that case, I suggest specifying zero OID for Put with a tombstone here:

neofs-node/pkg/services/object/acl/v2/service.go

Lines 638 to 646 in 3f6a367

op, verb, verbv2 := acl.OpObjectPut, sessionSDK.VerbObjectPut, sessionSDKv2.VerbObjectPut

tombstone := header.GetObjectType() == protoobject.ObjectType_TOMBSTONE

if tombstone {

// such objects are specific - saving them is essentially the removal of other

// objects

op, verb = acl.OpObjectDelete, sessionSDK.VerbObjectDelete

}

reqInfo, err := b.findRequestInfo(request, cnr, op, verb, verbv2, obj)

And replace PUT with DELETE, as for token v1.

But why zero? Rather it can be an associated ID, we know it from the header.

cmd/neofs-cli/modules/object/util.go

roman-khimov · 2026-01-13T20:25:09Z

pkg/services/container/server.go

+}
+
+func (r nnsResolver) HasUser(name string, userID user.ID) (bool, error) {
+	cacheKey := fmt.Sprintf("%s|%s", name, userID.String())


Not very efficient.

pkg/services/container/server.go

roman-khimov · 2026-01-15T20:00:28Z

cmd/neofs-cli/modules/object/util.go

-		verb = sessionv2.VerbObjectDelete
+		// For DELETE, create context with two verbs:
+		// 1. DELETE for the deleted object
+		// 2. PUT for the tombstone


The meaning of OID for DELETE is to represent deleted OID.

roman-khimov · 2026-01-15T20:24:13Z

pkg/innerring/processors/container/common.go

+	if err != nil {
+		return fmt.Errorf("get current block count: %w", err)
+	}
+	bh, err := cp.cnrClient.Morph().GetBlockHeader(idx - 1)


IR is subscribed to headers, it should have this data somewhere.

roman-khimov · 2026-01-15T20:30:35Z

pkg/services/container/server.go

+	if err != nil {
+		return token, fmt.Errorf("get FS chain block count: %w", err)
+	}
+	header, err := s.GetBlockHeader(idx - 1)


SN also has this data from the latest header. Doing header lookups per-request is too costly.

roman-khimov · 2026-01-15T20:41:54Z

internal/crypto/object.go

 		}
 	case neofscrypto.N3:
-		if sessionToken != nil {
+		if sessionToken != nil || sessionTokenV2 != nil {


Imagine a v2 token signed for some NNS names and one account signing something with it. It can be contract-based. This couldn't happen with v1 token, but for v2 it's totally possible.

roman-khimov · 2026-01-15T20:44:26Z

pkg/services/object/acl/v2/service.go

+		origin = origin.Origin()
+	}
+
+	neoPub, err := keys.NewPublicKeyFromBytes(key, elliptic.P256())


Can be an N3 signature at any step of v2 chain.

roman-khimov · 2026-01-15T20:46:22Z

pkg/services/object/acl/v2/service.go

+
+func (b Service) verifySessionTokenV2AgainstRequest(token sessionSDKv2.Token, reqVerb sessionSDKv2.Verb, reqCnr cid.ID, reqObj oid.ID) error {
+	// When we PUT a tombstone, the requested object is not zero,
+	// but the session is not bound to it because the user cannot predict its ID.


Something has to substitute it for associated ID above. IIRC this was the case once upon a time for v1 tokens.

Set subjects to default session token from `session-subjects` and `session-subjects-nns` flags for put, delete and lock operations. Signed-off-by: Andrey Butusov <andrey@nspcc.io>

Signed-off-by: Andrey Butusov <andrey@nspcc.io>

Check new session tokens in inner ring container processors. Signed-off-by: Andrey Butusov <andrey@nspcc.io>

Check container requests with new v2 session tokens, verify them using the nns resolver. Signed-off-by: Andrey Butusov <andrey@nspcc.io>

Check object requests with new v2 session tokens, verify them using the nns resolver. Pass the v2 session token through the slicer, set them to the object session token, and authorize objects using the token. Signed-off-by: Andrey Butusov <andrey@nspcc.io>

End-rey self-assigned this Nov 7, 2025

End-rey force-pushed the new-session-token-v2 branch from 5bba446 to f730e2f Compare November 7, 2025 20:53

End-rey force-pushed the new-session-token-v2 branch 4 times, most recently from 41ab8d0 to e66bf4b Compare November 18, 2025 12:30

End-rey mentioned this pull request Nov 18, 2025

nns: add user target helper and RPC binding nspcc-dev/neofs-contract#544

Merged

End-rey force-pushed the new-session-token-v2 branch 2 times, most recently from eed01c8 to f9d051d Compare December 12, 2025 15:42

End-rey force-pushed the new-session-token-v2 branch 2 times, most recently from 5b82365 to cea1b4d Compare December 20, 2025 23:05

This was referenced Dec 22, 2025

NNS user check #3749

Merged

Cli session token v2 #3750

Merged

End-rey force-pushed the new-session-token-v2 branch from cea1b4d to 2122d4d Compare December 22, 2025 18:37

cthulhu-rider mentioned this pull request Dec 25, 2025

Container attributes #3733

Merged

roman-khimov added a commit that referenced this pull request Dec 25, 2025

Cli session token v2 (#3750)

d4dafbb

Part of #3671.

End-rey force-pushed the new-session-token-v2 branch 5 times, most recently from eb453b4 to 1a9aab2 Compare December 26, 2025 16:11

End-rey marked this pull request as ready for review December 26, 2025 16:26

End-rey requested review from carpawell, cthulhu-rider and roman-khimov as code owners December 26, 2025 16:26

End-rey mentioned this pull request Dec 26, 2025

Support new session token v2 decoding nspcc-dev/neofs-testcases#1254

Closed

carpawell reviewed Dec 30, 2025

View reviewed changes

End-rey force-pushed the new-session-token-v2 branch from 1a9aab2 to b39cd77 Compare January 12, 2026 15:14

End-rey mentioned this pull request Jan 12, 2026

EC restores incorrect time.Time value #3771

Closed

End-rey requested a review from carpawell January 12, 2026 16:00

roman-khimov reviewed Jan 13, 2026

View reviewed changes

End-rey force-pushed the new-session-token-v2 branch 2 times, most recently from ee17ebb to 3f6a367 Compare January 14, 2026 12:39

End-rey requested a review from roman-khimov January 14, 2026 12:49

End-rey force-pushed the new-session-token-v2 branch from 3f6a367 to 245a33a Compare January 14, 2026 14:08

roman-khimov reviewed Jan 15, 2026

View reviewed changes

End-rey force-pushed the new-session-token-v2 branch from 245a33a to a5ef555 Compare January 16, 2026 18:18

End-rey added 2 commits January 16, 2026 21:20

cli/object: create session token V2 by default

69f01ab

Set subjects to default session token from `session-subjects` and `session-subjects-nns` flags for put, delete and lock operations. Signed-off-by: Andrey Butusov <andrey@nspcc.io>

internal: add struct for managing chain timestamps

d3b14bd

Signed-off-by: Andrey Butusov <andrey@nspcc.io>

End-rey force-pushed the new-session-token-v2 branch 3 times, most recently from 1936daf to 9a6fcc8 Compare January 16, 2026 19:28

End-rey added 3 commits January 16, 2026 22:29

ir: add new session token v2

ca0dda4

Check new session tokens in inner ring container processors. Signed-off-by: Andrey Butusov <andrey@nspcc.io>

container: add new session token v2

4f5df41

Check container requests with new v2 session tokens, verify them using the nns resolver. Signed-off-by: Andrey Butusov <andrey@nspcc.io>

	op, verb, verbv2 := acl.OpObjectPut, sessionSDK.VerbObjectPut, sessionSDKv2.VerbObjectPut
	tombstone := header.GetObjectType() == protoobject.ObjectType_TOMBSTONE
	if tombstone {
	// such objects are specific - saving them is essentially the removal of other
	// objects
	op, verb = acl.OpObjectDelete, sessionSDK.VerbObjectDelete
	}

	reqInfo, err := b.findRequestInfo(request, cnr, op, verb, verbv2, obj)

	// When we PUT a tombstone, the requested object is not zero,
	// but the session is not bound to it because the user cannot predict its ID.
	if !reqObj.IsZero() && reqVerb != sessionSDKv2.VerbObjectPut {
	if !token.AssertObject(reqVerb, reqCnr, reqObj) {
	return errors.New("v2 session token does not authorize access to the object")
	}
	} else {
	if !token.AssertVerb(reqVerb, reqCnr) {

Session token V2 #3671

Are you sure you want to change the base?

Session token V2 #3671

Conversation

End-rey commented Nov 7, 2025

Uh oh!

codecov bot commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov bot commented Nov 7, 2025 •

edited

Loading