storage: some acl methods fail on empty (private) acl

[pdknsk]

Easiest to set this up with gsutil. Please notice the verbose message.

$ gsutil defacl set private gs://bucket
Setting default object ACL on gs://bucket/...
$ gsutil defacl get gs://bucket
No default object ACL present for gs://bucket. This could occur if the default object ACL is private, in which case objects created in this bucket will be readable only by their creators.
[]

In particular acl.reload and acl.save don't work, probably others too.

>>> acl = storage.acl.DefaultObjectACL(bucket)
>>> acl.get_entities()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/user/.local/lib/python2.7/site-packages/gcloud/storage/acl.py", line 358, in get_entities
    self._ensure_loaded()
  File "/home/user/.local/lib/python2.7/site-packages/gcloud/storage/acl.py", line 192, in _ensure_loaded
    self.reload()
  File "/home/user/.local/lib/python2.7/site-packages/gcloud/storage/acl.py", line 409, in reload
    for entry in found['items']:
KeyError: 'items'
>>> acl.get_entities()
[]
>>> acl.reload()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/user/.local/lib/python2.7/site-packages/gcloud/storage/acl.py", line 409, in reload
    for entry in found['items']:
KeyError: 'items'
>>> acl.save()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/user/.local/lib/python2.7/site-packages/gcloud/storage/acl.py", line 453, in save
    for entry in result[self._URL_PATH_ELEM]:
KeyError: 'defaultObjectAcl'

This works fine if the default ACL is set to project-private rather than private.

[dhermes]

@pdknsk Thanks again for the great report!

I don't fully understand the meaning of private

It seems this is fixed easily by replacing found['items'] with found.get('items', []) and replacing result[self._URL_PATH_ELEM] with result.get(self._URL_PATH_ELEM, []).

---

Clarification: Are you authorized as yourself via gsutil when setting private?

Are you authorized as a service account when using gcloud-python?

[pdknsk]

It's a predefined ACL. I use the same owner account for both, set up with gcloud auth.

[dhermes]

@pdknsk Do you use gcloud auth with a user account (e.g. [email protected]) and then use a service account with gcloud-python?

[pdknsk]

Nope, it's a user account in both cases.