Blob IAM support apparently invalid

[tseaver]

While writing system tests for the requester_pays feature, I triggered the following:

Traceback (most recent call last):
  File "/home/tseaver/projects/agendaless/Google/src/google-cloud-python/storage/tests/system.py", line 372, in test_blob_acl_iam_w_user_project
    blob.set_iam_policy(policy)
  File "/home/tseaver/projects/agendaless/Google/src/google-cloud-python/storage/google/cloud/storage/blob.py", line 1148, in set_iam_policy
    _target_object=None)
  File "/home/tseaver/projects/agendaless/Google/src/google-cloud-python/storage/.nox/sys-3-6/lib/python3.6/site-packages/google/cloud/_http.py", line 293, in api_request
    raise exceptions.from_http_response(response)
google.api.core.exceptions.BadRequest: 400 PUT https://www.googleapis.com/storage/v1/b/new_1506705016579/o/SmallFile/iam?userProject=citric-celerity-697: roles/storage.objectViewer is not a valid role for projects/_/buckets/new_1506705016579/objects/SmallFile#0.

Note that the earlier call to Blob.get_iam_policy does succeed, returning:

(Pdb) pp policy.to_api_repr()
{'bindings': [{'members': ['projectEditor:some-project-742',
                           'projectOwner:some-project-742',
                           'serviceAccount:1065521786570-19reuv03qbdp37du41inh9gtd1s35g1j@developer.gserviceaccount.com'],
               'role': 'roles/storage.legacyObjectOwner'},
              {'members': ['projectViewer:some-project-742'],
               'role': 'roles/storage.legacyObjectReader'},
              {'members': ['allUsers'], 'role': 'roles/storage.objectViewer'}],
 'etag': 'CAM='}

We don't have existing system tests for Blob.set_iam_policy, but the Storage IAM docs don't define any IAM operations for blobs, only for buckets and projects. Indeed, they say:

To learn about controlling access to individual objects in your buckets, see Access Control Lists.

The API documentation for Objects also doesn't (any longer?) show getIamPolicy, setIamPolicy, or testIamPermissions.

@lukesneeringer can you loop somebody in to clarify?

[tseaver]

@frankyn confirmed to me offline:

There is no Object level IAM only Object Level ACL.

[tseaver]

It turns out that Blob.set_iam_policy can only assign the following "legacy" roles:

• roles/storage.legacyObjectReader
• roles/storage.legacyObjectOwner

[frankyn]

IAM object-level methods should not be deprecated. We should document how to use these methods to assign legacy roles instead.

[tseaver]

@frankyn ISTM that the back-end docs need to be updated correspondingly (and first, so that we track them without guesswork).

[frankyn]

Good point. I'm working on resolving this in Storage docs. I'll update this issue.

[tseaver]

@frankyn ping?

[frankyn]

I'm out of office until Monday! I'll pick back up then. Apologies for the delay.

…

On Jan 4, 2018 11:37 AM, "Tres Seaver" ***@***.***> wrote: @frankyn <https://github.com/frankyn> ping? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#4087 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AB0bwLK3FIgA9YM7FBKKDqZqVkh518DDks5tHRpVgaJpZM4PpDhF> .

[frankyn]

@tseaver docs were blocked by an internal bug and I will check-in again this week. Apologies for the delay.

[tseaver]

@frankyn I still don't see API documentation for objects.getIamPermissions et. al.

[frankyn]

Will update soon. I need to sync with a few stakeholders on the GCS team before continuing there exist additional open questions before introducing the docs back into the world. Setting up meeting for mid-next week given some are OOO. I will have a better update then. Thank you for patience.

[frankyn]

Sent a document for GCS team review to determine consensus for what to do here.

[tseaver]

@frankyn ping?

[frankyn]

Hey @tseaver, responding through hangouts.