flysystem-google-cloud-storage icon indicating copy to clipboard operation
flysystem-google-cloud-storage copied to clipboard

upload fails with uniform access controls

Open bindermuehle opened this issue 5 years ago • 4 comments

The problem is that upload fails if $options['predefinedAcl'] is set and this option is set by default on every upload GoogleStorageAdapter line 139: protected function getOptionsFromConfig(Config $config)

error message: "code": 400, "message": "Cannot use ACL API to set object policy when object policies are disabled."

I don't see a clear cut path to fix this because the bucket cannot be queried for the acl type $bucket->acl()->get() will fail with a 400 as well on a bucket with uniform access controls

The path forward is either open a bug with at https://github.com/googleapis/google-cloud-php-storage to make the type property somehow accessible. Another option would be to catch BadRequestHttpException on $bucket->upload and try again with the acl removed. I would consider this inefficient because every request will have to be sent at least twice.

Maybe there are other options and I overlooked something.

bindermuehle avatar Jan 15 '20 10:01 bindermuehle

Maybe this could be solved like this: https://github.com/googleapis/google-cloud-php/pull/2541/files

razvanphp avatar Jan 27 '20 11:01 razvanphp

I believe the problem is that change in google-cloud-php means $options['predefinedAcl'] should not exist if the bucket has uniform access control. There is currently no way to control this via the config, as if the visibility is unset, it defaults to sending fine-grained private visibility.

https://github.com/Superbalist/flysystem-google-cloud-storage/blob/f3ec295003c52502a33ef8b97ed1b184ffb89871/src/GoogleStorageAdapter.php#L143-L149

wmather avatar Apr 20 '20 13:04 wmather

#114

maelga avatar Jul 20 '21 16:07 maelga

I've gone down the path of manually updating what I needed to get this done: https://www.kublermdk.com/2022/01/29/googlecloud-flysystem-tweaks-to-support-uniform-bucket-level-access/

I assume others of you are doing the same given this has been an issue for so long.

kublermdk avatar Jan 28 '22 15:01 kublermdk