Skip to content

sn/object: fix NOT_PRESENT matching unavailable attributes - #4302

Open
End-rey wants to merge 3 commits into
masterfrom
4296-eacl-unavailable-attributes
Open

End-rey wants to merge 3 commits into
masterfrom
4296-eacl-unavailable-attributes

Conversation

@End-rey

@End-rey End-rey commented Nov 11, 2026

Copy link
Copy Markdown
Contributor

Closes #4296.

@codecov

codecov Bot commented Nov 11, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 32.82%. Comparing base (1193c44) to head (72c341f).

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4302      +/-   ##
==========================================
+ Coverage   32.71%   32.82%   +0.10%     
==========================================
  Files         673      673              
  Lines       41701    41708       +7     
==========================================
+ Hits        13644    13690      +46     
+ Misses      28057    28018      -39     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Skip SEARCH and DELETE eACL rules requiring unavailable object attributes
instead of treating them as absent. Continue evaluating subsequent rules.

Closes #4296.

Signed-off-by: Andrey Butusov <andrey@nspcc.io>
Include address headers when checking SearchV2 requests so object filters
can match the requested container ID.

Signed-off-by: Andrey Butusov <andrey@nspcc.io>
@End-rey
End-rey force-pushed the 4296-eacl-unavailable-attributes branch from 89fde5c to 4af9b13 Compare November 11, 2026 08:32
Register cleanup in both TestErrorReporting subtests to stop background
GC before their test loggers become invalid. Otherwise GC can log after
a subtest completes and panic during subsequent tests.
```
panic: Log in goroutine after TestErrorReporting/ignore_errors_by_default has completed: 2026-11-11T08:35:27.396Z	DEBUG	started expired objects handling	{"shard_id": "PQsradCGbmrg4kiknznTtg", "epoch": 0}
	 [recovered, repanicked]
```

Signed-off-by: Andrey Butusov <andrey@nspcc.io>
Comment thread pkg/services/object/acl/acl_test.go Resolved
if reqInfo.Operation == acl.OpObjectSearch || reqInfo.Operation == acl.OpObjectDelete {
// Object attributes are unavailable for these operations, not absent.
// Skip rules requiring them so NOT_PRESENT cannot match spuriously.
table.SetRecords(slices.DeleteFunc(slices.Clone(table.Records()), func(r eacl.Record) bool {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems very dangerous to me, EACL table shouldn't be mangled. Likely there are other ways to fix it.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, I'll move the fix to the SDK validator so the eACL table stays intact.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

NOT_PRESENT on an object attribute denies every SEARCH and DELETE

2 participants