options.public to storage/File.createWriteStream doesn't make uploaded files public

According to API docs, storage/File.createWriteStream should take a boolean option public that makes the uploaded file publicly readable. However, in my experience this isn't the case.

I create the stream like this:

let cloudFileStream = cloudFile.createWriteStream({
  public: true,
  resumable: false,
})

And still, I have to call cloudFile.makePublic after the upload has finished, because otherwise the file is only accessible to the owner:

cloudFileStream
  .on('finish', () => {
    cloudFile.makePublic()
  })

Environment details

OS: OS X El Capitan
Node.js version: 6.4.0
npm version: 3.10.6
google-cloud-node version: 0.39.0

Setting public: true will set the object's predefinedAcl to publicRead. Calling file.makePublic() will grant the READER role to allUsers. Do you have any existing rules that might be trumping the predefinedAcl?

To test, I created a new bucket and new file, so that no existing configuration could get in the way.

The bucket's permissions:

The bucket's default object permissions:

The bucket's contents:

The file's permissions:

@stephenplusplus

@stephenplusplus So, the only issue here should be an existing rule trumping predefinedAcl? Am not aware of having any such rule, but I'll look.

@stephenplusplus

@stephenplusplus How did you add the allusers: Reader bit? Does this correspond to predefinedAcl: publicRead?

@jgeewax

Yes, that came from setting predefinedAcl: publicRead.

@jgeewax, am I giving out correct information?

@stephenplusplus

@stephenplusplus OK, so that should mean that predefinedAcl: publicRead is equivalent to calling file.makePublic() does it not? I end up with the same in my file permissions, by calling file.makePublic().

We saw this same issue lately as well. We used the CLI (since the UI didn't have this feature) to change the predefinedAcl on the whole bucket since we didn't want to call file.makePublic() on every file.

It would be ideal if the option worked as expected and make the file public.

@jgeewax

I would like to resolve this the right way once and for all! I'm going to need some help from @jgeewax, @omaray, maybe @Capstan. Simply put, what needs to be in an upload request body that makes the file being uploaded public? Thanks!

@stephenplusplus

@stephenplusplus Come to think of it, how would you write a test for this issue? Apparently it's not solved, so seems as if you lack a test for this functionality.

We do: https://github.com/GoogleCloudPlatform/google-cloud-node/blob/35573c31e834c841b99ae73f6cf5e647b76ae7cc/packages/storage/system-test/storage.js#L424 -- but if we're not doing it the right way, we'll need to rewrite the test.

@stephenplusplus

@stephenplusplus I guess there's some sort of false positive there, looks that way at least.

Indeed, looking forward to fixing this :)

@stephenplusplus

@stephenplusplus When you upload an object, you can specify either a predefined ACL or a fully-enumerated ACL, and you get errors if you have both. If you don't want to bother writing client logic, you could just always turn public: true to the predefined ACL but then also use whatever client-provided ACL and let the service return the error that you cannot cross the streams. Seems like a bad idea to have the client specify one ACL that doesn't set it to public read and another in the same request that does. Or perhaps I'm misunderstanding and there's no additional user-provided ACL?

We're not really running into conflicting ACL specifications during the upload here. In the simplest case, a user might want to upload a file and make it public in one line, and it would look like this:

bucket.upload('./localfile.txt', { public: true }, function(err) {})

That would send POST https://.../o?name=localfile.txt&predefinedAcl=publicRead.

Is this what our library should do, or is there more to it?

I presume there's no body to the POST if resumable and it also contains an uploadType URL parameter that's either media or resumable? If so, then, that's exactly what it should do. Does the ACL you get back from such an object not list allUsers: READER?