File method to check whether an Object is Public

[avin3sh]

Right now there exist no method on File object to explicitly check whether a given a file is Public or Not.

There should be a way to check this.

[frankyn]

(Following this from the GCP Slack Channel for Storage)
One way to determine if a file is public is to download it without credentials.

The XML API version: https://storage.googleapis.com/bucket-name/object-name.

A library isn't necessary in this case and requires accessing the object payload which may be large. A workaround for large objects is to not download all the data if the object is public.

An alternative it to review ACL and IAM permissions, but it's rather complex given permissions can be set at the Project, Bucket and Object level. I'd recommend not adding support that determines if an object is public by reviewing permissions.

[AVaksman]

There is an example of isFilePublic() workaround shown in the system tests.

or more generic implementation

  async function isFilePublic(file: File) {
    try {
      const [aclObject] = await file.acl.get({entity: 'allUsers'});
      if ((aclObject as AccessControlObject).entity === 'allUsers' &&
          (aclObject as AccessControlObject).role === 'READER') {
        return true;
      } else {
        return false;
      }
    } catch (error) {
      if (error.code === 404) {
        return false;
      } else {
        throw error;
      }
    }
  }

@frankyn would you consider a wrapper method for above?

[frankyn]

Thanks @AVaksman!

The issue with the helper function is a user not having the necessary permissions to verify the object and bucket level ACL or IAM policy at a bucket level. This helper method only verifies the object ACL if they're set.

Example Case:
The object is public because the bucket-level IAM has the binding roles/storage.objectViewer for allUsers but the user does not have necessary permissions to perform Bucket.getIamPolicy().

If a user only has permission to perform a ACL GET request on an object and the Object ACL does not have READER for allUsers then the wrapper would return false.

This can lead to user confusion that the object is not public when it really is public.

[stephenplusplus]

One way to determine if a file is public is to download it without credentials.
A library isn't necessary in this case and requires accessing the object payload which may be large.

Is it possible to just send a HEAD to the URL? That should bypass downloading the object into memory.

[frankyn]

Thanks for chiming in with that option @stephenplusplus. I didn't know about that HTTP HEAD request.
Using HEAD sounds reasonable given it won't attempt to download the entire blob.

I recommend using the format http://bucket-name.storage.googleapis.com/file-name