Support predefined ACLs in gcloud.storage

[pdknsk]

https://cloud.google.com/storage/docs/access-control#predefined-acl

Maybe I just can't figure out how to do this.

[jgeewax]

Taking code from http://googlecloudplatform.github.io/gcloud-python/latest/storage-acl.html :

from gcloud import storage
connection = storage.get_connection(project)
bucket = connection.get_bucket(bucket_name)
acl = bucket.acl

The "predefined ACLs" would be (followed by acl.save())

ACL	Equivalent	Thoughts?
private	acl.all().revoke_read().revoke_write()	A bit verbose...
project-private	acl.all().revoke_read().revoke_write() and acl.user(...).grant_read().grant_write()	Very verbose... Also need to know who's in the project...
public-read	acl.all().grant_read()	Fine as is
public-read-write	acl.all().grant_read().grant_write()	A bit verbose, not a huge issue though
authenticated-read	acl.all_authenticated().grant_read()	Fine as is
bucket-owner-read	acl.user(...).grant_read()	Need to know who's in the owners list...
bucket-owner-full-control	acl.user(...).grant_owner()	Need to know who's in the owners list...

I think it'd be worthwhile addressing some of these in the future... Thoughts guys?

[dhermes]

For posterity, at the time of @jgeewax writing, latest referred to http://googlecloudplatform.github.io/gcloud-python/0.4.0/storage-acl.html

[pdknsk]

I think it'll be a bit more difficult, at least trying to emulate it. I tried your suggestion for private. It just adds an empty Entity for allUsers, which is discarded when saved.

Setting a predefined acl for a bucket or object seems relatively easy according to the docs.

To apply the predefined ACL private [...], you can use the predefinedAcl query string parameter and specify an empty acl property in a patch request.

Maybe I'm reading it wrong, but it doesn't seem possible to set the default acl to a predefined acl with the JSON API.

[jgeewax]

OK that's bad then... We need to make sure that we can cover these use cases.

I'm not sure if the predefined ACLs are a gsutil concept, or an API-level concept. Your comment makes me think it's the former.

[pdknsk]

I was wrong, JSON API supports both. It's a documentation error. (Only XML API instructions are listed.)

For buckets, predefinedAcl and predefinedDefaultObjectAcl does the work. Similar for objects.

[tseaver]

I guess we could update the save() methods of BucketACL and ObjectACL (and the corresponding Default* classes) to take an optional string paramter, predefined, e.g.:

    def save(self, acl=None, predefined=None):
        """Save the ACL data for this blob.

        :type acl: :class:`gcloud.storage.acl.ACL`
        :param acl: The ACL object to save.  If left blank, this will
                    save the entries set locally on the ACL.

        :type predefined: string
        :param predefined: An identifier for a predefined ACL.
                           If passed, `acl` must be None.
        """

In the case that predefined was passed, we would generate the PATCH request with the additional query string parameter, and would not pass the data payload.

[jgeewax]

Could we be more explicit ? set_predefined_acl(str) ? Or is that crazy?