Function checkAuthResults

lib/api/api.js:184–223

(authResults, apiMethod, log)

}

function checkAuthResults(authResults, apiMethod, log) {
    let returnTagCount = true;
    const isImplicitDeny = {};
    let isOnlyImplicitDeny = true;
    if (apiMethod === 'objectGet') {
        // first item checks s3:GetObject(Version) action
        if (!authResults[0].isAllowed && !authResults[0].isImplicit) {
            log.trace('get object authorization denial from Vault');
            return errors.AccessDenied;
        }
        isImplicitDeny[authResults[0].action] = authResults[0].isImplicit;
        // second item checks s3:GetObject(Version)Tagging action
        if (!authResults[1].isAllowed) {
            log.trace('get tagging authorization denial ' +
            'from Vault');
            returnTagCount = false;
        }
    } else {
        for (let i = 0; i < authResults.length; i++) {
            isImplicitDeny[authResults[i].action] = true;
            if (!authResults[i].isAllowed && !authResults[i].isImplicit) {
                // Any explicit deny rejects the current API call
                log.trace('authorization denial from Vault');
                return errors.AccessDenied;
            }
            if (authResults[i].isAllowed) {
                // If the action is allowed, the result is not implicit
                // Deny.
                isImplicitDeny[authResults[i].action] = false;
                isOnlyImplicitDeny = false;
            }
        }
    }
    // These two APIs cannot use ACLs or Bucket Policies, hence, any
    // implicit deny from vault must be treated as an explicit deny.
    if ((apiMethod === 'bucketPut' || apiMethod === 'serviceGet') && isOnlyImplicitDeny) {
        return errors.AccessDenied;
    }
    return { returnTagCount, isImplicitDeny };
}

/* eslint-disable no-param-reassign */
function handleAuthorizationResults(request, authorizationResults, apiMethod, returnTagCount, log, callback) {