From cdeaf8cb2767045213d7f0f180215f821b60d989 Mon Sep 17 00:00:00 2001 From: Thiyagu K Date: Tue, 28 Jul 2026 13:54:33 +0000 Subject: [PATCH 1/2] test: skip ACL tests when uniform bucket-level access is enabled --- handwritten/storage/system-test/storage.ts | 91 ++++++++++++++++++---- 1 file changed, 78 insertions(+), 13 deletions(-) diff --git a/handwritten/storage/system-test/storage.ts b/handwritten/storage/system-test/storage.ts index cf8074d52671..1088ec63b41a 100644 --- a/handwritten/storage/system-test/storage.ts +++ b/handwritten/storage/system-test/storage.ts @@ -235,12 +235,22 @@ describe('storage', function () { ); }); - it('should get access controls', async () => { + it('should get access controls', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const accessControls = await bucket.acl.get(); assert(Array.isArray(accessControls)); }); - it('should add entity to default access controls', async () => { + it('should add entity to default access controls', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const [accessControl] = await bucket.acl.default.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -255,12 +265,22 @@ describe('storage', function () { await bucket.acl.default.delete({entity: USER_ACCOUNT}); }); - it('should get default access controls', async () => { + it('should get default access controls', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const accessControls = await bucket.acl.default.get(); assert(Array.isArray(accessControls)); }); - it('should grant an account access', async () => { + it('should grant an account access', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const [accessControl] = await bucket.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -275,7 +295,12 @@ describe('storage', function () { await bucket.acl.delete(opts); }); - it('should update an account', async () => { + it('should update an account', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const [accessControl] = await bucket.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -350,7 +375,12 @@ describe('storage', function () { } }); - it('should make files private', async () => { + it('should make files private', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + await Promise.all( ['a', 'b', 'c'].map(text => createFileWithContentPromise(text)), ); @@ -381,7 +411,12 @@ describe('storage', function () { await file.delete(); }); - it('should get access controls', async () => { + it('should get access controls', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const [accessControls] = await file.acl.get(); assert(Array.isArray(accessControls)); }); @@ -391,7 +426,12 @@ describe('storage', function () { assert.strictEqual(typeof (file as any).default, 'undefined'); }); - it('should grant an account access', async () => { + it('should grant an account access', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const [accessControl] = await file.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -405,7 +445,12 @@ describe('storage', function () { await file.acl.delete({entity: USER_ACCOUNT}); }); - it('should update an account', async () => { + it('should update an account', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const [accessControl] = await file.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -434,7 +479,12 @@ describe('storage', function () { await file.acl.delete({entity: 'allUsers'}); }); - it('should make a file private', async () => { + it('should make a file private', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const validateMakeFilePrivateRejects = (err: ApiError) => { assert.strictEqual(err.code, 404); assert.strictEqual(err!.errors![0].reason, 'notFound'); @@ -507,7 +557,12 @@ describe('storage', function () { }); }); - it('should make a file private from a resumable upload', async () => { + it('should make a file private from a resumable upload', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const validateMakeFilePrivateRejects = (err: ApiError) => { assert.strictEqual((err as ApiError)!.code, 404); assert.strictEqual((err as ApiError).errors![0].reason, 'notFound'); @@ -1159,7 +1214,12 @@ describe('storage', function () { describe('preserves bucket/file ACL over uniform bucket-level access on/off', () => { beforeEach(createBucket); - it('should preserve default bucket ACL', async () => { + it('should preserve default bucket ACL', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + await bucket.acl.default.update(customAcl); const [aclBefore] = await bucket.acl.default.get(); @@ -1178,7 +1238,12 @@ describe('storage', function () { } }).timeout(UNIFORM_ACCESS_TIMEOUT); - it('should preserve file ACL', async () => { + it('should preserve file ACL', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const file = bucket.file(`file-${crypto.randomUUID()}`); await file.save('data', {resumable: false}); From e8a5d2ebfa2822cdd70bfa26002077e348c7df5f Mon Sep 17 00:00:00 2001 From: Thiyagu K Date: Tue, 28 Jul 2026 14:42:53 +0000 Subject: [PATCH 2/2] test: skip system tests involving ACL and public IAM roles --- handwritten/storage/system-test/storage.ts | 148 ++++++++++----------- 1 file changed, 67 insertions(+), 81 deletions(-) diff --git a/handwritten/storage/system-test/storage.ts b/handwritten/storage/system-test/storage.ts index 1088ec63b41a..012189084f59 100644 --- a/handwritten/storage/system-test/storage.ts +++ b/handwritten/storage/system-test/storage.ts @@ -235,22 +235,20 @@ describe('storage', function () { ); }); - it('should get access controls', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should get access controls', async () => { const accessControls = await bucket.acl.get(); assert(Array.isArray(accessControls)); }); - it('should add entity to default access controls', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should add entity to default access controls', async () => { const [accessControl] = await bucket.acl.default.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -265,22 +263,20 @@ describe('storage', function () { await bucket.acl.default.delete({entity: USER_ACCOUNT}); }); - it('should get default access controls', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should get default access controls', async () => { const accessControls = await bucket.acl.default.get(); assert(Array.isArray(accessControls)); }); - it('should grant an account access', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should grant an account access', async () => { const [accessControl] = await bucket.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -295,12 +291,11 @@ describe('storage', function () { await bucket.acl.delete(opts); }); - it('should update an account', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should update an account', async () => { const [accessControl] = await bucket.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -375,12 +370,11 @@ describe('storage', function () { } }); - it('should make files private', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should make files private', async () => { await Promise.all( ['a', 'b', 'c'].map(text => createFileWithContentPromise(text)), ); @@ -411,12 +405,11 @@ describe('storage', function () { await file.delete(); }); - it('should get access controls', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should get access controls', async () => { const [accessControls] = await file.acl.get(); assert(Array.isArray(accessControls)); }); @@ -426,12 +419,11 @@ describe('storage', function () { assert.strictEqual(typeof (file as any).default, 'undefined'); }); - it('should grant an account access', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should grant an account access', async () => { const [accessControl] = await file.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -445,12 +437,11 @@ describe('storage', function () { await file.acl.delete({entity: USER_ACCOUNT}); }); - it('should update an account', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should update an account', async () => { const [accessControl] = await file.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -479,12 +470,11 @@ describe('storage', function () { await file.acl.delete({entity: 'allUsers'}); }); - it('should make a file private', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should make a file private', async () => { const validateMakeFilePrivateRejects = (err: ApiError) => { assert.strictEqual(err.code, 404); assert.strictEqual(err!.errors![0].reason, 'notFound'); @@ -557,12 +547,11 @@ describe('storage', function () { }); }); - it('should make a file private from a resumable upload', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should make a file private from a resumable upload', async () => { const validateMakeFilePrivateRejects = (err: ApiError) => { assert.strictEqual((err as ApiError)!.code, 404); assert.strictEqual((err as ApiError).errors![0].reason, 'notFound'); @@ -1214,12 +1203,11 @@ describe('storage', function () { describe('preserves bucket/file ACL over uniform bucket-level access on/off', () => { beforeEach(createBucket); - it('should preserve default bucket ACL', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should preserve default bucket ACL', async () => { await bucket.acl.default.update(customAcl); const [aclBefore] = await bucket.acl.default.get(); @@ -1238,12 +1226,11 @@ describe('storage', function () { } }).timeout(UNIFORM_ACCESS_TIMEOUT); - it('should preserve file ACL', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should preserve file ACL', async () => { const file = bucket.file(`file-${crypto.randomUUID()}`); await file.save('data', {resumable: false}); @@ -3205,9 +3192,8 @@ describe('storage', function () { }); /** - * TODO: Re-enable once the test environment allows public IAM roles. - * Currently disabled to avoid 403 errors when adding 'allUsers' or - * 'allAuthenticatedUsers' permissions. + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. */ it.skip('should respect predefined Acl at file#copy', async () => { const opts = {destination: 'CloudLogo'};