Function routeMetadata

lib/routes/routeMetadata.js:30–109

(clientIP, request, response, log)

}

function routeMetadata(clientIP, request, response, log) {
    // Attach the apiMethod method to the request, so it can used by monitoring in the server
    // eslint-disable-next-line no-param-reassign
    request.apiMethod = 'routeMetadata';

    const { bootstrap } = config.bucketd;
    if (bootstrap.length === 0) {
        log.debug('cloudserver is not configured with bucketd', {
            bucketdConfig: config.bucketd,
        });
        return responseJSONBody(errors.ServiceUnavailable, null, response, log);
    }
    log.debug('routing request', { method: 'routeMetadata' });
    log.addDefaultFields({ clientIP, httpMethod: request.method });
    _normalizeMetadataRequest(request);

    // restrict access to only routes ending in bucket, log or id
    const { resourceType, subResource } = request;
    if (resourceType === 'admin'
        && !['bucket', 'log', 'id'].includes(subResource)) {
        return responseJSONBody(errors.NotImplemented, null, response, log);
    }
    const ip = requestUtils.getClientIp(request, config);
    const isSecure = requestUtils.getHttpProtocolSecurity(request, config);
    const requestContexts = [new RequestContext(request.headers, request.query,
        request.generalResource, request.specificResource, ip,
        isSecure, request.resourceType, 'metadata')];
    return waterfall([
        next => auth.server.doAuth(request, log, (err, userInfo, authRes) => {
            if (err) {
                log.debug('authentication error', {
                    error: err,
                    method: request.method,
                    bucketName: request.bucketName,
                    objectKey: request.objectKey,
                });
                return next(err);
            }
            // authRes is not defined for account credentials
            if (authRes && !authRes[0].isAllowed) {
                return next(errors.AccessDenied);
            }
            return next(null, userInfo);
        }, 's3', requestContexts),
        (userInfo, next) => {
            if (userInfo.getCanonicalID() === constants.publicId) {
                log.debug('unauthenticated access to API routes', {
                    method: request.method,
                    bucketName: request.bucketName,
                    objectKey: request.objectKey,
                });
                return next(errors.AccessDenied);
            }
            const { url } = request;
            const path = url.startsWith('/_/metadata/admin') ?
                url.replace('/_/metadata/admin/', '/_/') :
                url.replace('/_/metadata/', '/');
            // bucketd is always configured on the loopback interface in s3c