storage: iam support - #2060

@jmuk -- blocked for now, as I'm waiting to be whitelisted.

@danoscarmike Can you reach out to the GCS team and ask them to whitelist Stephen?

Requested, standby...

@danoscarmike any updates?

I seem to have been whitelisted-- I haven't checked for the CI account yet.

I had an issue with setting a policy:

PUT https://www.googleapis.com/storage/v1/b/gcloud-test-86d6a2e0-130f-11e7-aa15-43bde3d9a94b/iam

Request Body

  {
    "resourceId": "buckets/gcloud-test-86d6a2e0-130f-11e7-aa15-43bde3d9a94b",                                 
    "bindings": [                                                                                             
      {                                                                                                       
        "role": "roles/storage.objectViewer",                                                                 
        "members": [                                                                                          
          "allUsers"                                                                                          
        ]                                                                                                     
      }                                                                                                       
    ]                                                                                                         
  }                                                                                                                                                                                                                      

This returns: Invalid argument.

@stephenplusplus You need a version and should probably be following the read-modify-write pattern as well, providing an etag

Thanks! I don't see a version property documented here: https://cloud.google.com/storage/docs/json_api/v1/buckets/setIamPolicy.

Using the Pub/Sub IAM endpoint as a reference, the etag isn't required. I'm struggling to get one through to the API as well, but I'm working on that.

Is one of / are both version and etag required?

@stephenplusplus looks like Cloud Storage implements a non-standard version of IAM (this is basically because it's an old API into which IAM was backported, all new APIs will share a common implementation which includes version, which is soley for user use, and the API doesn't care about, the new APIs should probably share an IAM implementatoin, as most new APIs will be launching with IAM support.)

As for that particular request I'm not sure why it failed now. I would make sure you have permissions to grant all users access, and maybe try a different role/member set combo.

@stephenplusplus What do you need from me to unblock you? We would like to get this done this week.

#2060 (comment)

It would save a lot of guess work if someone knew what a request body would look like that will not return the Invalid error.

@bjwatson @anthmgoogle Is there someone I can tag in to find out about this?

@stephenplusplus @callmehiphop You should be whitelisted now. Can you try again?

System tests pass now, just needs unit tests.

Unit tests done, ready for your review @callmehiphop!

Coverage remained the same at 100.0% when pulling da91d49 on stephenplusplus:spp--2057 into 326ad28 on GoogleCloudPlatform:master.

Coverage remained the same at 100.0% when pulling 33ef55c on stephenplusplus:spp--2057 into 326ad28 on GoogleCloudPlatform:master.