mirror of
https://github.com/discourse/discourse.git
synced 2026-03-04 01:15:08 +08:00
This commit introduces a `s3_enable_access_control_tags` site setting which, when enabled, adds a `discourse:acl` tag with values `public` or `private` to S3 objects created by the application. The presence of the tags on S3 objects enables bucket administrators to implement tag-based access control policies, providing an alternative to object ACLs which AWS now discourages. The `discourse:acl` tag can be customized via the `s3_access_control_tag_key ` site setting. Values for `public` and `private` can also be customized via the `s3_access_control_tag_public_value` and `s3_access_control_tag_private_value ` site settings respectively. ### Reviewer Notes To test it locally, run the following commands in your working discourse directory: 1. `script/install_minio_binaries.rb` 2. Start a local minio server by running: `bundle exec rails runner script/local_minio_s3.rb` 3. bundle exec rails runner "SiteSetting.enable_s3_uploads = true" 5. Start your development rails server with the following environment variables: `DISCOURSE_ENABLE_S3_UPLOADS=true DISCOURSE_S3_ENABLE_ACCESS_CONTROL_TAGS=true DISCOURSE_BACKUP_LOCATION=s3`
41 lines
1,007 B
Ruby
41 lines
1,007 B
Ruby
# frozen_string_literal: true
|
|
|
|
RSpec.describe Jobs::SyncAccessControlForUploads do
|
|
let(:upload1) { Fabricate(:upload) }
|
|
let(:upload2) { Fabricate(:upload) }
|
|
let(:upload3) { Fabricate(:secure_upload) }
|
|
let(:upload_ids) { [upload1.id, upload2.id, upload3.id] }
|
|
|
|
def run_job
|
|
described_class.new.execute(upload_ids: upload_ids)
|
|
end
|
|
|
|
it "does nothing if not using external storage" do
|
|
Upload.expects(:where).never
|
|
run_job
|
|
end
|
|
|
|
context "with external storage enabled" do
|
|
before do
|
|
setup_s3
|
|
stub_s3_store
|
|
end
|
|
|
|
it "runs update_upload_access_control for each upload" do
|
|
Discourse.store.expects(:update_upload_access_control).times(3)
|
|
run_job
|
|
end
|
|
|
|
it "handles updates throwing an exception" do
|
|
Discourse
|
|
.store
|
|
.expects(:update_upload_access_control)
|
|
.raises(StandardError)
|
|
.then
|
|
.returns(true, true)
|
|
.times(3)
|
|
Discourse.expects(:warn_exception).once
|
|
run_job
|
|
end
|
|
end
|
|
end
|