Function removeBucketActions

pkg/policy/bucket-policy.go:283–341

Removes bucket actions for given policy in given statement.

(statement Statement, prefix, bucketResource string, readOnlyInUse, writeOnlyInUse bool)

// Removes bucket actions for given policy in given statement.
func removeBucketActions(statement Statement, prefix, bucketResource string, readOnlyInUse, writeOnlyInUse bool) Statement {
	removeReadOnly := func() {
		if !statement.Actions.Intersection(readOnlyBucketActions).Equals(readOnlyBucketActions) {
			return
		}

		if statement.Conditions == nil {
			statement.Actions = statement.Actions.Difference(readOnlyBucketActions)
			return
		}

		if prefix != "" {
			stringEqualsValue := statement.Conditions["StringEquals"]
			values := set.NewStringSet()
			if stringEqualsValue != nil {
				values = stringEqualsValue["s3:prefix"]
				if values == nil {
					values = set.NewStringSet()
				}
			}

			values.Remove(prefix)

			if stringEqualsValue != nil {
				if values.IsEmpty() {
					delete(stringEqualsValue, "s3:prefix")
				}
				if len(stringEqualsValue) == 0 {
					delete(statement.Conditions, "StringEquals")
				}
			}

			if len(statement.Conditions) == 0 {
				statement.Conditions = nil
				statement.Actions = statement.Actions.Difference(readOnlyBucketActions)
			}
		}
	}

	removeWriteOnly := func() {
		if statement.Conditions == nil {
			statement.Actions = statement.Actions.Difference(writeOnlyBucketActions)
		}
	}

	if len(statement.Resources) > 1 {
		statement.Resources.Remove(bucketResource)
	} else {
		if !readOnlyInUse {
			removeReadOnly()
		}

		if !writeOnlyInUse {
			removeWriteOnly()
		}
	}

	return statement