Fix delete objects permissions bug (treeverse#1260)

itaiad200 · web-flow · commit 774e935c2d9f · 2021-01-21T11:58:00.000+02:00
diff --git a/gateway/handler.go b/gateway/handler.go
@@ -247,6 +247,15 @@ func authorize(w http.ResponseWriter, req *http.Request, authService simulator.G
 	o := ctx.Value(ContextKeyOperation).(*operations.Operation)
 	username := ctx.Value(ContextKeyUser).(*model.User).Username
 	authContext := ctx.Value(ContextKeyAuthContext).(sig.SigContext)
+
+	if len(perms) == 0 {
+		// Either no permissions are required, or they will be checked later.
+		return &operations.AuthorizedOperation{
+			Operation: o,
+			Principal: username,
+		}
+	}
+
 	authResp, err := authService.Authorize(&auth.AuthorizationRequest{
 		Username:            username,
 		RequiredPermissions: perms,
diff --git a/nessie/delete_objects_test.go b/nessie/delete_objects_test.go
@@ -0,0 +1,51 @@
+package nessie
+
+import (
+	"strconv"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDeleteObjects(t *testing.T) {
+	ctx, _, repo := setupTest(t)
+	const numOfObjects = 10
+
+	identifiers := make([]*s3.ObjectIdentifier, 0, numOfObjects)
+
+	for i := 1; i <= numOfObjects; i++ {
+		file := strconv.Itoa(i) + ".txt"
+		identifiers = append(identifiers, &s3.ObjectIdentifier{
+			Key: aws.String(masterBranch + "/" + file),
+		})
+		_, _ = uploadFileRandomData(ctx, t, repo, masterBranch, file)
+	}
+
+	listOut, err := svc.ListObjects(&s3.ListObjectsInput{
+		Bucket: aws.String(repo),
+		Prefix: aws.String(masterBranch + "/"),
+	})
+
+	assert.NoError(t, err)
+	assert.Len(t, listOut.Contents, numOfObjects)
+
+	deleteOut, err := svc.DeleteObjects(&s3.DeleteObjectsInput{
+		Bucket: aws.String(repo),
+		Delete: &s3.Delete{
+			Objects: identifiers,
+		},
+	})
+
+	assert.NoError(t, err)
+	assert.Len(t, deleteOut.Deleted, numOfObjects)
+
+	listOut, err = svc.ListObjects(&s3.ListObjectsInput{
+		Bucket: aws.String(repo),
+		Prefix: aws.String(masterBranch + "/"),
+	})
+
+	assert.NoError(t, err)
+	assert.Len(t, listOut.Contents, 0)
+}
