feat(storage): add IpFilter support to bucket metadata

handwritten/storage/src/bucket.ts

@@ -328,6 +328,47 @@ export interface EncryptionEnforcementConfig {
   restrictionMode?: 'NotRestricted' | 'FullyRestricted';
   readonly effectiveTime?: string;
 }
+
+/**
+ * Configuration for a bucket's IP Filter.
+ * 
+ * @example
+ * ```
+ * const {Storage} = require('@google-cloud/storage');
+ * const storage = new Storage();
+ * const bucket = storage.bucket('my-bucket');
+ * 
+ * const metadata = {
+ *   ipFilter: {
+ *     mode: 'Enabled',
+ *     publicNetworkSource: {
+ *       allowedIpCidrRanges: ['192.168.1.1/32']
+ *     }
+ *   }
+ * };
+ * 
+ * bucket.setMetadata(metadata, (err, apiResponse) => {
+ *   if (err) {
+ *     console.error(err);
+ *   } else {
+ *     console.log('IP filter updated successfully.');
+ *   }
+ * });
+ * ```
+ */
+export interface IpFilter {
+  mode?: 'Enabled' | 'Disabled';
+  publicNetworkSource?: {
+    allowedIpCidrRanges?: string[];
+  };
+  vpcNetworkSources?: {
+    network?: string;
+    allowedIpCidrRanges?: string[];
+  }[];
+  allowAllServiceAgentAccess?: boolean;
+  allowCrossOrgVpcs?: boolean;
+}
+
 export interface BucketMetadata extends BaseMetadata {
   acl?: AclMetadata[] | null;
   autoclass?: {
@@ -361,6 +402,7 @@ export interface BucketMetadata extends BaseMetadata {
       lockedTime?: string;
     };
   };
+  ipFilter?: IpFilter | null;
   labels?: {
     [key: string]: string | null;
   };

handwritten/storage/system-test/storage.ts

@@ -44,6 +44,7 @@ interface ErrorCallbackFunction {
 }
 import {PubSub, Subscription, Topic} from '@google-cloud/pubsub';
 import {getDirName} from '../src/util.js';
+import {BucketMetadata} from '../src/bucket.js';
 
 class HTTPError extends Error {
   code: number;
@@ -1294,6 +1295,79 @@ describe('storage', function () {
   });
 
   describe('bucket metadata', () => {
+    describe('ipFilter', () => {
+      let ipFilterBucket: Bucket;
+
+      before(async () => {
+        ipFilterBucket = storage.bucket(generateName());
+        await ipFilterBucket.create();
+      });
+
+      after(async () => {
+        await ipFilterBucket.delete().catch(() => { });
+      });
+
+      it('should set ipFilter', async () => {
+        const metadata: BucketMetadata = {
+          ipFilter: {
+            mode: 'Disabled',
+            publicNetworkSource: {
+              allowedIpCidrRanges: ['0.0.0.0/0', '::/0'],
+            },
+            allowAllServiceAgentAccess: false,
+          },
+        };
+        const [meta] = await ipFilterBucket.setMetadata(metadata);
+        assert.deepStrictEqual(meta.ipFilter, metadata.ipFilter);
+      });
+
+      it('should get ipFilter', async () => {
+        const [meta] = await ipFilterBucket.getMetadata();
+        assert.strictEqual(meta.ipFilter?.mode, 'Disabled');
+        assert.deepStrictEqual(
+          meta.ipFilter?.publicNetworkSource?.allowedIpCidrRanges,
+          ['0.0.0.0/0', '::/0']
+        );
+      });
+
+      it('should update ipFilter', async () => {
+        const metadata: BucketMetadata = {
+          ipFilter: {
+            mode: 'Disabled',
+            publicNetworkSource: {
+              allowedIpCidrRanges: ['203.0.113.0/24'],
+            },
+            allowAllServiceAgentAccess: false,
+          },
+        };
+        const [meta] = await ipFilterBucket.setMetadata(metadata);
+        assert.deepStrictEqual(meta.ipFilter, metadata.ipFilter);
+      });
+
+      it('should clear allowedIpCidrRanges', async () => {
+        const [getMeta] = await ipFilterBucket.getMetadata();
+        assert.strictEqual(getMeta.ipFilter?.mode, 'Disabled');
+        assert.deepStrictEqual(
+          getMeta.ipFilter?.publicNetworkSource?.allowedIpCidrRanges,
+          ['203.0.113.0/24']
+        );
+
+        const metadata: BucketMetadata = {
+          ipFilter: {
+            mode: 'Disabled',
+            publicNetworkSource: {
+              allowedIpCidrRanges: [],
+            },
+            allowAllServiceAgentAccess: false,
+          },
+        };
+        const [meta] = await ipFilterBucket.setMetadata(metadata);
+        assert.strictEqual(meta.ipFilter?.mode, 'Disabled');
+        assert.strictEqual(meta.ipFilter?.publicNetworkSource?.allowedIpCidrRanges, undefined);
+        assert.strictEqual(meta.ipFilter?.allowAllServiceAgentAccess, false);
+      });
+    });
+
     it('should allow setting metadata on a bucket', async () => {
       const metadata = {
         website: {
@@ -4590,7 +4664,7 @@ describe('storage', function () {
       setTimeout(resolve, RETENTION_DURATION_SECONDS * 1000),
     );
     return Promise.all(
-      buckets.map(bucket => limit(() => deleteBucketAsync(bucket))),
+      buckets.map(bucket => limit(() => deleteBucketAsync(bucket).catch(() => {}))),
     );
   }
 

handwritten/storage/test/bucket.ts

@@ -3692,5 +3692,132 @@ describe('Bucket', () => {
         bucket.setMetadata(clearMetadata, assert.ifError);
       });
     });
+
+    describe('ipFilter', () => {
+      it('should enable ipFilter', done => {
+        const metadata = {
+          ipFilter: {
+            mode: 'Enabled',
+            publicNetworkSource: {
+              allowedIpCidrRanges: ['192.168.1.1/32'],
+            },
+          },
+        };
+
+        bucket.setMetadata = (metadata_: BucketMetadata) => {
+          assert.deepStrictEqual(metadata_.ipFilter, metadata.ipFilter);
+          done();
+        };
+
+        bucket.setMetadata(metadata, assert.ifError);
+      });
+
+      it('should update ipFilter', done => {
+        const metadata = {
+          ipFilter: {
+            mode: 'Enabled',
+            vpcNetworkSources: [
+              {
+                network: 'projects/my-project/global/networks/my-vpc',
+                allowedIpCidrRanges: ['10.0.0.0/8'],
+              },
+            ],
+          },
+        };
+
+        bucket.setMetadata = (metadata_: BucketMetadata) => {
+          assert.deepStrictEqual(metadata_.ipFilter, metadata.ipFilter);
+          done();
+        };
+
+        bucket.setMetadata(metadata, assert.ifError);
+      });
+
+      it('should get ipFilter', done => {
+        const ipFilter = {
+          mode: 'Enabled',
+          publicNetworkSource: {
+            allowedIpCidrRanges: ['192.168.1.1/32'],
+          },
+          vpcNetworkSources: [
+            {
+              network: 'projects/my-project/global/networks/my-vpc',
+              allowedIpCidrRanges: ['10.0.0.0/8'],
+            },
+          ],
+          allowAllServiceAgentAccess: true,
+          allowCrossOrgVpcs: true,
+        };
+
+        bucket.getMetadata = () => {
+          return Promise.resolve([{ipFilter}]);
+        };
+
+        bucket.getMetadata().then((data: any) => {
+          const [metadata] = data;
+          assert.deepStrictEqual(metadata.ipFilter, ipFilter);
+          done();
+        });
+      });
+
+      it('should clear allowedIpCidrRanges', done => {
+        const initialIpFilter = {
+          mode: 'Disabled',
+          publicNetworkSource: {
+            allowedIpCidrRanges: ['203.0.113.0/24'],
+          },
+        };
+
+        const updatedIpFilter = {
+          mode: 'Disabled',
+          publicNetworkSource: {
+            allowedIpCidrRanges: undefined,
+          },
+          allowAllServiceAgentAccess: false,
+        };
+
+        bucket.getMetadata = () => {
+          return Promise.resolve([{ipFilter: initialIpFilter}]);
+        };
+
+        bucket.setMetadata = (metadata: any) => {
+          assert.deepStrictEqual(metadata.ipFilter.publicNetworkSource.allowedIpCidrRanges, []);
+
+          return Promise.resolve([{ipFilter: updatedIpFilter}]);
+        };
+
+        bucket.getMetadata()
+          .then((data: any) => {
+            const [getMeta] = data;
+            assert.strictEqual(getMeta.ipFilter?.mode, 'Disabled');
+            assert.deepStrictEqual(
+              getMeta.ipFilter?.publicNetworkSource?.allowedIpCidrRanges,
+              ['203.0.113.0/24']
+            );
+
+            const metadataUpdate = {
+              ipFilter: {
+                mode: 'Disabled',
+                publicNetworkSource: {
+                  allowedIpCidrRanges: [],
+                },
+                allowAllServiceAgentAccess: false,
+              },
+            };
+
+            return bucket.setMetadata(metadataUpdate);
+          })
+          .then((data: any) => {
+            const [meta] = data;
+            assert.strictEqual(meta.ipFilter?.mode, 'Disabled');
+            assert.strictEqual(meta.ipFilter?.publicNetworkSource?.allowedIpCidrRanges, undefined);
+            assert.strictEqual(meta.ipFilter?.allowAllServiceAgentAccess, false);
+            done();
+          })
+          .catch((err: any) => {
+            done(err);
+          });
+      });
+    });
   });
-});
+});

handwritten/storage/test/index.ts

@@ -1258,6 +1258,48 @@ describe('Storage', () => {
         }
       );
     });
+
+    it('should list buckets with ipFilter summary', done => {
+      const bucketsResponse = [
+        {
+          name: 'bucket-with-filter',
+          metadata: {
+            ipFilter: {
+              mode: 'Enabled',
+              allowCrossOrgVpcs: true,
+              allowAllServiceAgentAccess: true
+            }
+          }
+        },
+        {
+          name: 'bucket-without-filter',
+          metadata: {
+            location: 'US'
+          }
+        }
+      ];
+
+      storage.getBuckets = () => {
+        return Promise.resolve([bucketsResponse]);
+      };
+
+      storage.getBuckets().then((data: any) => {
+        const [buckets] = data;
+        const filteredBucket = buckets.find((b: any) => b.name === 'bucket-with-filter');
+        const normalBucket = buckets.find((b: any) => b.name === 'bucket-without-filter');
+
+        assert.ok(filteredBucket.metadata.ipFilter);
+        assert.strictEqual(filteredBucket.metadata.ipFilter.mode, 'Enabled');
+        assert.strictEqual(filteredBucket.metadata.ipFilter.allowCrossOrgVpcs, true);
+
+        assert.strictEqual(normalBucket.metadata.ipFilter, undefined);
+
+        done();
+      })
+      .catch((err: any) => {
+        done(err);
+      });
+    });
   });
 
   describe('getHmacKeys', () => {