Hi @Tarrow, can you please associate one or more active project tags with this task (via the Add Action... → Change Project Tags dropdown)? That will allow to see a task when looking at project workboards or searching for tasks in certain projects, and get notified about a task when watching a related project tag. Thanks!

Looking at the object in Google Clouds console it's super unclear why this thing isn't visible.

Clicking the public URL link returns that access denied page as you would expect.

The Authenticated URL does work while l'm logged in

PRs:

• https://github.com/wmde/wbaas-deploy/pull/1366
• https://github.com/wbstack/api/pull/725

This ticket is now munged together with https://phabricator.wikimedia.org/T354744 as we rolled back the original changes in order to ship something else.

After working on https://phabricator.wikimedia.org/T354744 I think the brokenness of the logo for coffeebase.wikibase.dev is the result of unwanted manual editing of file level ACLs, and there is nothing to fix on a code level here.

We could however check if it's possible to recursively list all files in a bucket and list their ACLs. In case we find any other broken assets we can then manually fix these.

I came up with a script for hunting down files with unexpected ACLs:

#!/usr/bin/env node

const fs = require('fs')

;(async () => {
	const stdinBuffer = fs.readFileSync(0)
	const items = JSON.parse(stdinBuffer.toString())
	const objects = items.filter(i => i.type === 'cloud_object')
	const withMalformedAcls = objects.filter((object) => {
		if (!object.metadata || !object.metadata.acl || !Array.isArray(object.metadata.acl)) {
			return true
		}
		const hasProperOwner = object.metadata.acl.some((acl) => {
			return acl.role === 'OWNER' && /wikibase-(dev|cloud)-api@wikibase-cloud\.iam\.gserviceaccount\.com/.test(acl.entity)
		})
		const hasProperReader = object.metadata.acl.some((acl) => {
			return acl.role === 'READER' && acl.entity === 'allUsers'
		})
		return !hasProperOwner || !hasProperReader
	})
	return withMalformedAcls.map((object) => object.metadata.name)
})()
	.then((output) => {
		console.log(output)
	})
	.catch((err) => {
		console.error(err)
		process.exit(1)
	})

which can read the input from gcloud storage ls --recursive --json gs://$BUCKET_NAME.

Unfortunately it seems there are still assets in that bucket where my Google Cloud Account is not allowed to read all object metadata.

Staging has now been cleaned up manually and has all assets with the expected ACLs

Production had 3 assets with bad ACLs, all of them being caused by https://github.com/wbstack/api/pull/729

I fixed these manually and now production is clean as well.

I'll put this ticket in review now, waiting a few days until I check the buckets once more. In case results are still empty then, we can consider this done.

Things still look ok as of now. Closing this ticket.