File Acl permissions

[lafama]

Is it possible to add permissions (allUsers:readers) to a file during uploading

var myBucket = gcs.bucket('testbucket');
var file = myBucket.file('test.png');
file.createWriteStream({
    gzip: true,
set permission to allUsers:readers
})

[stephenplusplus]

There is, though it's a little more wordy than our API is usually:

file.createWriteStream({
    metadata: {
      acl: [
        {
          entity: 'allUsers',
          role: gcloud.storage.acl.READER_ROLE
        }
      ]
    }
  });

I'm struggling to think of a clean way to make that easier, but if you have any ideas, we will gladly try to accommodate!

[lafama]

I have tried that, but the file gets uploaded and no permissions are set. Here is my modified code

fs.createReadStream('test.png')
              .pipe(file.createWriteStream({
                metadata:{
                    acl:[
                    {
                        entity:'allUsers',
                        role:gcs.acl.READER_ROLE
                    }
                    ]
                }
              }
              ))
              .on('error', function(err) {
                done();
              })
              .on('complete', function(metadata) {
                    done();

              });

am i missing something

[stephenplusplus]

I don't think so, that looks right to me. Can you paste what metadata returns in the complete callback?

Also, what version of gcloud are you running?

[lafama]

{ kind: 'storage#object',
  id: 'xxxx/temp/test.png/1439816836081000',
  selfLink: 'https://www.googleapis.com/storage/v1/b/xxxx/o/temp%2Ftest.png',
  name: 'temp/test.png',
  bucket: 'xxxx',
  generation: '1439816836081000',
  metageneration: '1',
  contentType: 'image/png',
  updated: '2015-08-17T13:07:16.080Z',
  storageClass: 'STANDARD',
  size: '53844',
  md5Hash: 'zAp5LEFzw2l',
  mediaLink: 'https://www.googleapis.com/download/storage/v1/b/xxx/o/temp%2Ftest.png?generation=1439816836081000&alt=media',
  acl: 
   [ { kind: 'storage#objectAccessControl',
       id: 'xxx/temp/test.png/1439816836081000/allUsers',
       selfLink: 'https://www.googleapis.com/storage/v1/b/xxxx/o/temp%2Ftest.png/acl/allUsers',
       bucket: 'xxxx',
       object: 'temp/test.png',
       generation: '1439816836081000',
       entity: 'allUsers',
       role: 'READER',
       etag: 'COjKEAE=' },
     { kind: 'storage#objectAccessControl',
       id: 'xxx/temp/test.png/1439816836081000/user-00b4903770f8e313045586eab55',
       selfLink: 'https://www.googleapis.com/storage/v1/b/xxxx/o/temp%2Ftest.png/acl/user-00b4903770f8e313045586eab55',
       bucket: 'xxx',
       object: 'temp/test.png',
       generation: '1439816836081000',
       entity: 'user-00b4903770f8e313045586eab55',
       role: 'OWNER',
       entityId: '00b4903770f8e313045586eab55',
       etag: 'COjKudiXsMcCEAE=' } ],
  owner: 
   { entity: 'user-00b4903770f8e313045586eab55',
     entityId: '00b4903770f8e313045586eab55' },
  crc32c: 'LOOQ==',
  etag: 'COjcCEAE=' }

[lafama]

Am using version 0.18.0

[stephenplusplus]

It looks like the right permissions were added:

metadata.acl[0] = {
  // ...
  entity: 'allUsers',
  role: 'READER'
}

How are you verifying the file is not being given the right permissions?

[lafama]

I was accessing it using the console.developers.google.com UI, and i cant set any permissions using it
am getting

Please include at least one owner's permission

However i have tested the actual url and its accessible to the public.

[stephenplusplus]

I get the "Please include at least one owner's permission" if I try to remove the owner permission.

After clicking the X next to the owner's permission:

Does your permissions dialog look different than mine?

[lafama]

This is what i get on the permissions dialog (no permissions are listed)

and on the bucket list view

[stephenplusplus]

@jgeewax I think you're the resident expert at ACLs. Is there any reason a file would say it uploaded would have this metadata, but then list nothing (see above screenshot)?

[lafama]

Anyone with leads on this issue?

[jgeewax]

Hmm weird. Is it possible that somehow we're overriding the owner (which should be the service account that uploaded the object) which leads to a weird situation in the UI?

[lafama]

How can I test this case

[stephenplusplus]

// @jgeewax

We're passing this metadata with the upload:

metadata.acl = [
  {
    entity: 'allUsers',
    role: 'READER'
  }
]

[jgeewax]

/cc @Capstan : Any idea what's going on here? Apparently the metadata response says it has an owner, but the UI disagrees.... ?

[Capstan]

You cannot change the owner of an object. You can only overwrite an object and become the new owner. The UI is being a little simplistic in that being the owner implies having OWNER permission. You can grant other ACL entities OWNER permission, but you cannot remove the owner from the ACL list.

If you provide an ACL list on creation, we will naturally add the current user or service account creating the object to the ACLs.

FTR, use of predefined ACLs works as well.

[Capstan]

If you had, for instance, added another entity owner permission, the dialog would have happily allowed you to save. However, GCS would then quietly re-add the original owner back into the ACL. I've filed a bug against the UI for this behavior.

[jgeewax]

OK, so there's nothing we need to do differently then? We're not accidentally stripping an OWNER permission away when we shouldn't?

[Capstan]

No, I think you are set. If the user tries to remove the OWNER permission, the service will correct them; no need for fancy validation client-side.

[stephenplusplus]

Thanks @Capstan!

@lafama was that information helpful? Are you still having an issue?

[stephenplusplus]

@lafama please re-open if this is still an issue.