CLDSRV-1021: Evaluate the bucket policy against the copy source

lib/api/objectCopy.js

@@ -243,6 +243,9 @@ function objectCopy(authInfo, request, sourceBucket, sourceObject, sourceVersion
          */
         checkQuota: true,
         request,
+        // The request targets the destination, the bucket policy must be
+        // evaluated against the source
+        policyTarget: { bucketName: sourceBucket, objectKey: sourceObject },
     };
     const valPutParams = {
         authInfo,

lib/api/objectPutCopyPart.js

@@ -56,6 +56,9 @@ function objectPutCopyPart(authInfo, request, sourceBucket, sourceObject, reqVer
          */
         checkQuota: true,
         request,
+        // The request targets the destination, the bucket policy must be
+        // evaluated against the source
+        policyTarget: { bucketName: sourceBucket, objectKey: sourceObject },
     };
 
     const partNumber = Number.parseInt(request.query.partNumber, 10);

lib/metadata/metadataUtils.js

@@ -202,6 +202,8 @@ function metadataGetObjects(bucketName, objectsKeys, log, cb) {
  * @param {string} params.requestType - type of request
  * @param {string} [params.preciseRequestType] - precise type of request
  * @param {object} params.request - http request object
+ * @param {object} [params.policyTarget] - resource to evaluate the bucket
+ *   policy against when it differs from the request target
  *  @param {RequestLogger} log - request logger
  * @param {object} actionImplicitDenies - identity authorization results
  * @return {ArsenalError|null} returns a validation error, or null if validation OK
@@ -212,7 +214,7 @@ function metadataGetObjects(bucketName, objectsKeys, log, cb) {
  * - AccessDenied: bucket is not authorized
  */
 function validateBucket(bucket, params, log, actionImplicitDenies = {}) {
-    const { authInfo, preciseRequestType, request } = params;
+    const { authInfo, preciseRequestType, request, policyTarget } = params;
     let requestType = params.requestType;
     if (bucketShield(bucket, requestType)) {
         log.debug('bucket is shielded from request', {
@@ -249,6 +251,8 @@ function validateBucket(bucket, params, log, actionImplicitDenies = {}) {
             log,
             request,
             actionImplicitDenies,
+            false,
+            policyTarget,
         )
     ) {
         log.debug('access denied for user on bucket', { requestType });
@@ -349,13 +353,18 @@ function checkRateLimitIfNeeded(request, authInfo, bucketMD, log, callback) {
  * @param {object} [params.serverAccessLogOptions] - options for server access logging
  * @param {boolean} [params.serverAccessLogOptions.copySource] - if true, stores source bucket
  *   information in request.sourceServerAccessLog for copy operations
+ * @param {object} [params.policyTarget] - resource to evaluate the bucket policy against
+ *   when it differs from the request target, e.g. the source of a copy
+ * @param {string} params.policyTarget.bucketName - name of bucket
+ * @param {string} params.policyTarget.objectKey - name of object
  * @param {boolean} actionImplicitDenies - identity authorization results
  * @param {RequestLogger} log - request logger
  * @param {function} callback - callback
  * @return {undefined} - and call callback with params err, bucket md
  */
 function standardMetadataValidateBucketAndObj(params, actionImplicitDenies, log, callback) {
-    const { authInfo, bucketName, objectKey, versionId, getDeleteMarker, request, withVersionId } = params;
+    const { authInfo, bucketName, objectKey, versionId, getDeleteMarker, request, withVersionId, policyTarget } =
+        params;
     let requestType = params.requestType;
     if (!Array.isArray(requestType)) {
         requestType = [requestType];
@@ -433,6 +442,8 @@ function standardMetadataValidateBucketAndObj(params, actionImplicitDenies, log,
                         log,
                         request,
                         actionImplicitDenies,
+                        false,
+                        policyTarget,
                     )
                 ) {
                     log.debug('access denied for user on object', { requestType });