2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-03-04 01:15:08 +08:00
discourse/spec/jobs/sync_access_control_for_uploads_spec.rb
Alan Guo Xiang Tan b02bc707de
DEV: Add setting to tag s3 objects enabling tag based access control policies (#32988)
This commit introduces a `s3_enable_access_control_tags` site setting
which,
when enabled, adds a `discourse:acl` tag with values `public` or
`private` to
S3 objects created by the application. The presence of the tags on S3
objects
enables bucket administrators to implement tag-based access control
policies, providing an alternative to
object ACLs which AWS now discourages.

The `discourse:acl` tag can be customized via the
`s3_access_control_tag_key ` site setting.
Values for `public` and `private` can also be customized via the
`s3_access_control_tag_public_value` and
`s3_access_control_tag_private_value ` site settings respectively.

### Reviewer Notes

To test it locally, run the following commands in your working discourse
directory:

1. `script/install_minio_binaries.rb`
2. Start a local minio server by running: `bundle exec rails runner
script/local_minio_s3.rb`
3. bundle exec rails runner "SiteSetting.enable_s3_uploads = true"
5. Start your development rails server with the following environment
variables: `DISCOURSE_ENABLE_S3_UPLOADS=true
DISCOURSE_S3_ENABLE_ACCESS_CONTROL_TAGS=true
DISCOURSE_BACKUP_LOCATION=s3`
2025-06-16 13:26:18 +08:00

41 lines
1,007 B
Ruby

# frozen_string_literal: true
RSpec.describe Jobs::SyncAccessControlForUploads do
let(:upload1) { Fabricate(:upload) }
let(:upload2) { Fabricate(:upload) }
let(:upload3) { Fabricate(:secure_upload) }
let(:upload_ids) { [upload1.id, upload2.id, upload3.id] }
def run_job
described_class.new.execute(upload_ids: upload_ids)
end
it "does nothing if not using external storage" do
Upload.expects(:where).never
run_job
end
context "with external storage enabled" do
before do
setup_s3
stub_s3_store
end
it "runs update_upload_access_control for each upload" do
Discourse.store.expects(:update_upload_access_control).times(3)
run_job
end
it "handles updates throwing an exception" do
Discourse
.store
.expects(:update_upload_access_control)
.raises(StandardError)
.then
.returns(true, true)
.times(3)
Discourse.expects(:warn_exception).once
run_job
end
end
end