From 4df05129424d14675a96ab96c2c2418b8a0c4f55 Mon Sep 17 00:00:00 2001 From: Thiyagu K Date: Tue, 28 Jul 2026 13:54:33 +0000 Subject: [PATCH 1/3] test: skip ACL tests when uniform bucket-level access is enabled --- handwritten/storage/system-test/storage.ts | 91 ++++++++++++++++++---- 1 file changed, 78 insertions(+), 13 deletions(-) diff --git a/handwritten/storage/system-test/storage.ts b/handwritten/storage/system-test/storage.ts index cf8074d52671..1088ec63b41a 100644 --- a/handwritten/storage/system-test/storage.ts +++ b/handwritten/storage/system-test/storage.ts @@ -235,12 +235,22 @@ describe('storage', function () { ); }); - it('should get access controls', async () => { + it('should get access controls', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const accessControls = await bucket.acl.get(); assert(Array.isArray(accessControls)); }); - it('should add entity to default access controls', async () => { + it('should add entity to default access controls', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const [accessControl] = await bucket.acl.default.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -255,12 +265,22 @@ describe('storage', function () { await bucket.acl.default.delete({entity: USER_ACCOUNT}); }); - it('should get default access controls', async () => { + it('should get default access controls', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const accessControls = await bucket.acl.default.get(); assert(Array.isArray(accessControls)); }); - it('should grant an account access', async () => { + it('should grant an account access', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const [accessControl] = await bucket.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -275,7 +295,12 @@ describe('storage', function () { await bucket.acl.delete(opts); }); - it('should update an account', async () => { + it('should update an account', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const [accessControl] = await bucket.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -350,7 +375,12 @@ describe('storage', function () { } }); - it('should make files private', async () => { + it('should make files private', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + await Promise.all( ['a', 'b', 'c'].map(text => createFileWithContentPromise(text)), ); @@ -381,7 +411,12 @@ describe('storage', function () { await file.delete(); }); - it('should get access controls', async () => { + it('should get access controls', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const [accessControls] = await file.acl.get(); assert(Array.isArray(accessControls)); }); @@ -391,7 +426,12 @@ describe('storage', function () { assert.strictEqual(typeof (file as any).default, 'undefined'); }); - it('should grant an account access', async () => { + it('should grant an account access', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const [accessControl] = await file.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -405,7 +445,12 @@ describe('storage', function () { await file.acl.delete({entity: USER_ACCOUNT}); }); - it('should update an account', async () => { + it('should update an account', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const [accessControl] = await file.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -434,7 +479,12 @@ describe('storage', function () { await file.acl.delete({entity: 'allUsers'}); }); - it('should make a file private', async () => { + it('should make a file private', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const validateMakeFilePrivateRejects = (err: ApiError) => { assert.strictEqual(err.code, 404); assert.strictEqual(err!.errors![0].reason, 'notFound'); @@ -507,7 +557,12 @@ describe('storage', function () { }); }); - it('should make a file private from a resumable upload', async () => { + it('should make a file private from a resumable upload', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const validateMakeFilePrivateRejects = (err: ApiError) => { assert.strictEqual((err as ApiError)!.code, 404); assert.strictEqual((err as ApiError).errors![0].reason, 'notFound'); @@ -1159,7 +1214,12 @@ describe('storage', function () { describe('preserves bucket/file ACL over uniform bucket-level access on/off', () => { beforeEach(createBucket); - it('should preserve default bucket ACL', async () => { + it('should preserve default bucket ACL', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + await bucket.acl.default.update(customAcl); const [aclBefore] = await bucket.acl.default.get(); @@ -1178,7 +1238,12 @@ describe('storage', function () { } }).timeout(UNIFORM_ACCESS_TIMEOUT); - it('should preserve file ACL', async () => { + it('should preserve file ACL', async function () { + const [metadata] = await bucket.getMetadata(); + if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { + this.skip(); + } + const file = bucket.file(`file-${crypto.randomUUID()}`); await file.save('data', {resumable: false}); From da3934aeadbe8c0d6d14053a1fce8965c500a29d Mon Sep 17 00:00:00 2001 From: Thiyagu K Date: Tue, 28 Jul 2026 14:42:53 +0000 Subject: [PATCH 2/3] test: skip system tests involving ACL and public IAM roles --- handwritten/storage/system-test/storage.ts | 148 ++++++++++----------- 1 file changed, 67 insertions(+), 81 deletions(-) diff --git a/handwritten/storage/system-test/storage.ts b/handwritten/storage/system-test/storage.ts index 1088ec63b41a..012189084f59 100644 --- a/handwritten/storage/system-test/storage.ts +++ b/handwritten/storage/system-test/storage.ts @@ -235,22 +235,20 @@ describe('storage', function () { ); }); - it('should get access controls', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should get access controls', async () => { const accessControls = await bucket.acl.get(); assert(Array.isArray(accessControls)); }); - it('should add entity to default access controls', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should add entity to default access controls', async () => { const [accessControl] = await bucket.acl.default.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -265,22 +263,20 @@ describe('storage', function () { await bucket.acl.default.delete({entity: USER_ACCOUNT}); }); - it('should get default access controls', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should get default access controls', async () => { const accessControls = await bucket.acl.default.get(); assert(Array.isArray(accessControls)); }); - it('should grant an account access', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should grant an account access', async () => { const [accessControl] = await bucket.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -295,12 +291,11 @@ describe('storage', function () { await bucket.acl.delete(opts); }); - it('should update an account', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should update an account', async () => { const [accessControl] = await bucket.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -375,12 +370,11 @@ describe('storage', function () { } }); - it('should make files private', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should make files private', async () => { await Promise.all( ['a', 'b', 'c'].map(text => createFileWithContentPromise(text)), ); @@ -411,12 +405,11 @@ describe('storage', function () { await file.delete(); }); - it('should get access controls', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should get access controls', async () => { const [accessControls] = await file.acl.get(); assert(Array.isArray(accessControls)); }); @@ -426,12 +419,11 @@ describe('storage', function () { assert.strictEqual(typeof (file as any).default, 'undefined'); }); - it('should grant an account access', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should grant an account access', async () => { const [accessControl] = await file.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -445,12 +437,11 @@ describe('storage', function () { await file.acl.delete({entity: USER_ACCOUNT}); }); - it('should update an account', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should update an account', async () => { const [accessControl] = await file.acl.add({ entity: USER_ACCOUNT, role: storage.acl.OWNER_ROLE, @@ -479,12 +470,11 @@ describe('storage', function () { await file.acl.delete({entity: 'allUsers'}); }); - it('should make a file private', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should make a file private', async () => { const validateMakeFilePrivateRejects = (err: ApiError) => { assert.strictEqual(err.code, 404); assert.strictEqual(err!.errors![0].reason, 'notFound'); @@ -557,12 +547,11 @@ describe('storage', function () { }); }); - it('should make a file private from a resumable upload', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should make a file private from a resumable upload', async () => { const validateMakeFilePrivateRejects = (err: ApiError) => { assert.strictEqual((err as ApiError)!.code, 404); assert.strictEqual((err as ApiError).errors![0].reason, 'notFound'); @@ -1214,12 +1203,11 @@ describe('storage', function () { describe('preserves bucket/file ACL over uniform bucket-level access on/off', () => { beforeEach(createBucket); - it('should preserve default bucket ACL', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should preserve default bucket ACL', async () => { await bucket.acl.default.update(customAcl); const [aclBefore] = await bucket.acl.default.get(); @@ -1238,12 +1226,11 @@ describe('storage', function () { } }).timeout(UNIFORM_ACCESS_TIMEOUT); - it('should preserve file ACL', async function () { - const [metadata] = await bucket.getMetadata(); - if (metadata.iamConfiguration?.uniformBucketLevelAccess?.enabled) { - this.skip(); - } - + /** + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. + */ + it.skip('should preserve file ACL', async () => { const file = bucket.file(`file-${crypto.randomUUID()}`); await file.save('data', {resumable: false}); @@ -3205,9 +3192,8 @@ describe('storage', function () { }); /** - * TODO: Re-enable once the test environment allows public IAM roles. - * Currently disabled to avoid 403 errors when adding 'allUsers' or - * 'allAuthenticatedUsers' permissions. + * TODO: Re-enable once the test environment is configured without uniform bucket-level access. + * Currently disabled because uniform bucket-level access disables ACLs. */ it.skip('should respect predefined Acl at file#copy', async () => { const opts = {destination: 'CloudLogo'}; From d896c8693e80ecdfe5ad3179ba1442417c004a66 Mon Sep 17 00:00:00 2001 From: Thiyagu K Date: Wed, 5 Aug 2026 07:51:40 +0000 Subject: [PATCH 3/3] refactor: simplify TODO comment style in storage system tests --- handwritten/storage/system-test/storage.ts | 70 +++++----------------- 1 file changed, 14 insertions(+), 56 deletions(-) diff --git a/handwritten/storage/system-test/storage.ts b/handwritten/storage/system-test/storage.ts index 012189084f59..6482c1befb6c 100644 --- a/handwritten/storage/system-test/storage.ts +++ b/handwritten/storage/system-test/storage.ts @@ -235,19 +235,13 @@ describe('storage', function () { ); }); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should get access controls', async () => { const accessControls = await bucket.acl.get(); assert(Array.isArray(accessControls)); }); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should add entity to default access controls', async () => { const [accessControl] = await bucket.acl.default.add({ entity: USER_ACCOUNT, @@ -263,19 +257,13 @@ describe('storage', function () { await bucket.acl.default.delete({entity: USER_ACCOUNT}); }); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should get default access controls', async () => { const accessControls = await bucket.acl.default.get(); assert(Array.isArray(accessControls)); }); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should grant an account access', async () => { const [accessControl] = await bucket.acl.add({ entity: USER_ACCOUNT, @@ -291,10 +279,7 @@ describe('storage', function () { await bucket.acl.delete(opts); }); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should update an account', async () => { const [accessControl] = await bucket.acl.add({ entity: USER_ACCOUNT, @@ -370,10 +355,7 @@ describe('storage', function () { } }); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should make files private', async () => { await Promise.all( ['a', 'b', 'c'].map(text => createFileWithContentPromise(text)), @@ -405,10 +387,7 @@ describe('storage', function () { await file.delete(); }); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should get access controls', async () => { const [accessControls] = await file.acl.get(); assert(Array.isArray(accessControls)); @@ -419,10 +398,7 @@ describe('storage', function () { assert.strictEqual(typeof (file as any).default, 'undefined'); }); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should grant an account access', async () => { const [accessControl] = await file.acl.add({ entity: USER_ACCOUNT, @@ -437,10 +413,7 @@ describe('storage', function () { await file.acl.delete({entity: USER_ACCOUNT}); }); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should update an account', async () => { const [accessControl] = await file.acl.add({ entity: USER_ACCOUNT, @@ -470,10 +443,7 @@ describe('storage', function () { await file.acl.delete({entity: 'allUsers'}); }); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should make a file private', async () => { const validateMakeFilePrivateRejects = (err: ApiError) => { assert.strictEqual(err.code, 404); @@ -547,10 +517,7 @@ describe('storage', function () { }); }); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should make a file private from a resumable upload', async () => { const validateMakeFilePrivateRejects = (err: ApiError) => { assert.strictEqual((err as ApiError)!.code, 404); @@ -1203,10 +1170,7 @@ describe('storage', function () { describe('preserves bucket/file ACL over uniform bucket-level access on/off', () => { beforeEach(createBucket); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should preserve default bucket ACL', async () => { await bucket.acl.default.update(customAcl); const [aclBefore] = await bucket.acl.default.get(); @@ -1226,10 +1190,7 @@ describe('storage', function () { } }).timeout(UNIFORM_ACCESS_TIMEOUT); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should preserve file ACL', async () => { const file = bucket.file(`file-${crypto.randomUUID()}`); await file.save('data', {resumable: false}); @@ -3191,10 +3152,7 @@ describe('storage', function () { await Promise.all([file.delete, copiedFile.delete()]); }); - /** - * TODO: Re-enable once the test environment is configured without uniform bucket-level access. - * Currently disabled because uniform bucket-level access disables ACLs. - */ + // TODO: Re-enable once the test environment is configured without uniform bucket-level access. it.skip('should respect predefined Acl at file#copy', async () => { const opts = {destination: 'CloudLogo'}; const [file] = await bucket.upload(FILES.logo.path, opts);