add test_bucket_acl_no_grants

When the owner has no grants on their bucket, they should not be able to
write to it, but still read and write the ACL. Amazon allows users to
read the bucket, and our behavior is consistent with this.

diff --git a/s3tests/functional/test_s3.py b/s3tests/functional/test_s3.py
index de131cc1ea3202cf6a8cce57b40e039a3acb1253..481ec53a0dedfacef844dc3b0f13c3df5c99832a 100644 (file)
--- a/s3tests/functional/test_s3.py
+++ b/s3tests/functional/test_s3.py
@@ -952,6 +952,34 @@ def test_bucket_acl_grant_nonexist_user():
     eq(e.error_code, 'InvalidArgument')
 
 
+def test_bucket_acl_no_grants():
+    bucket = get_new_bucket()
+
+    # write content to the bucket
+    key = bucket.new_key('foo')
+    key.set_contents_from_string('bar')
+
+    # clear grants
+    policy = bucket.get_acl()
+    policy.acl.grants = []
+
+    # remove read/write permission
+    bucket.set_acl(policy)
+
+    # can read
+    bucket.get_key('foo')
+
+    # can't write
+    key = bucket.new_key('baz')
+    check_access_denied(key.set_contents_from_string, 'bar')
+
+    # can read acl
+    bucket.get_acl()
+
+    # can write acl
+    bucket.set_acl('private')
+
+
 # This test will fail on DH Objects. DHO allows multiple users with one account, which
 # would violate the uniqueness requirement of a user's email. As such, DHO users are
 # created without an email.