Function validateBucket

lib/metadata/metadataUtils.js:213–247

* Validate that a bucket is accessible and authorized to the user, * return a specific error code otherwise * * @param {BucketInfo} bucket - bucket info * @param {object} params - function parameters * @param {AuthInfo} params.authInfo - AuthInfo class instance, requester's info * @param {stri

(bucket, params, log, actionImplicitDenies = {})

 * - AccessDenied: bucket is not authorized
 */
function validateBucket(bucket, params, log, actionImplicitDenies = {}) {
    const { authInfo, preciseRequestType, request } = params;
    let requestType = params.requestType;
    if (bucketShield(bucket, requestType)) {
        log.debug('bucket is shielded from request', {
            requestType,
            method: 'validateBucket',
        });
        return errors.NoSuchBucket;
    }

    const canonicalID = authInfo.getCanonicalID();
    if (!Array.isArray(requestType)) {
        requestType = [requestType];
    }

    // Skip checking bucket ownership if the requesting user is the rate limit service user
    // and the requestType is Get/Put/DeleteBucketRateLimit.
    if (requestType.every(type => rateLimitApiActions.includes(type))
        && config.rateLimiting.enabled
        && isRateLimitServiceUser(authInfo)
    ) {
        return null;
    }

    if (bucket.getOwner() !== canonicalID && requestType.some(type => onlyOwnerAllowed.includes(type))) {
        return errors.MethodNotAllowed;
    }
    if (!isBucketAuthorized(bucket, (preciseRequestType || requestType), canonicalID,
        authInfo, log, request, actionImplicitDenies)) {
        log.debug('access denied for user on bucket', { requestType });
        return errors.AccessDenied;
    }
    return null;
}

/**
 * Check rate limiting if not already checked