feat(storage): add IpFilter support to bucket metadata

handwritten/storage/src/bucket.ts

@@ -308,6 +308,47 @@ export interface EncryptionEnforcementConfig {
   restrictionMode?: 'NotRestricted' | 'FullyRestricted';
   readonly effectiveTime?: string;
 }
+
+/**
+ * Configuration for a bucket's IP Filter.
+ *
+ * @example
+ * ```
+ * const {Storage} = require('@google-cloud/storage');
+ * const storage = new Storage();
+ * const bucket = storage.bucket('my-bucket');
+ *
+ * const metadata = {
+ *   ipFilter: {
+ *     mode: 'Enabled',
+ *     publicNetworkSource: {
+ *       allowedIpCidrRanges: ['192.168.1.1/32']
+ *     }
+ *   }
+ * };
+ *
+ * bucket.setMetadata(metadata, (err, apiResponse) => {
+ *   if (err) {
+ *     console.error(err);
+ *   } else {
+ *     console.log('IP filter updated successfully.');
+ *   }
+ * });
+ * ```
+ */
+export interface IpFilter {
+  mode?: 'Enabled' | 'Disabled';
+  publicNetworkSource?: {
+    allowedIpCidrRanges?: string[];
+  };
+  vpcNetworkSources?: {
+    network?: string;
+    allowedIpCidrRanges?: string[];
+  }[];
+  allowAllServiceAgentAccess?: boolean;
+  allowCrossOrgVpcs?: boolean;
+}
+
 export interface BucketMetadata extends BaseMetadata {
   acl?: AclMetadata[] | null;
   autoclass?: {
@@ -341,6 +382,7 @@ export interface BucketMetadata extends BaseMetadata {
       lockedTime?: string;
     };
   };
+  ipFilter?: IpFilter | null;
   labels?: {
     [key: string]: string | null;
   };

handwritten/storage/src/index.ts

@@ -146,6 +146,7 @@ export {
   GetNotificationsCallback,
   GetNotificationsOptions,
   GetNotificationsResponse,
+  IpFilter,
   Labels,
   LifecycleAction,
   LifecycleCondition,

handwritten/storage/system-test/storage.ts

@@ -44,6 +44,7 @@ interface ErrorCallbackFunction {
 }
 import {PubSub, Subscription, Topic} from '@google-cloud/pubsub';
 import {getDirName} from '../src/util.js';
+import {BucketMetadata} from '../src/bucket.js';
 
 class HTTPError extends Error {
   code: number;
@@ -1294,6 +1295,101 @@ describe('storage', function () {
   });
 
   describe('bucket metadata', () => {
+    describe('ipFilter', () => {
+      let ipFilterBucket: Bucket;
+
+      before(async () => {
+        ipFilterBucket = storage.bucket(generateName());
+        await ipFilterBucket.create();
+      });
+
+      after(async () => {
+        await ipFilterBucket.delete().catch(() => { });
+      });
+
+
+      it('should create a bucket with ipFilter', async () => {
+        const metadata: BucketMetadata = {
+          ipFilter: {
+            mode: 'Disabled',
+            publicNetworkSource: {
+              allowedIpCidrRanges: ['0.0.0.0/0'],
+            },
+            allowAllServiceAgentAccess: true,
+          },
+        };
+        const bucketToCreate = storage.bucket(generateName());
+        const [bucket, apiResponse] = await bucketToCreate.create(metadata);
+
+        assert.strictEqual(apiResponse.ipFilter?.mode, metadata.ipFilter?.mode);
+        assert.deepStrictEqual(apiResponse.ipFilter?.publicNetworkSource?.allowedIpCidrRanges, metadata.ipFilter?.publicNetworkSource?.allowedIpCidrRanges);
+        assert.strictEqual(apiResponse.ipFilter?.allowAllServiceAgentAccess, metadata.ipFilter?.allowAllServiceAgentAccess);
+
+        await bucket.delete().catch(() => {});
+      });
+
+      it('should set ipFilter', async () => {
+        const metadata: BucketMetadata = {
+          ipFilter: {
+            mode: 'Disabled',
+            publicNetworkSource: {
+              allowedIpCidrRanges: ['0.0.0.0/0', '::/0'],
+            },
+            allowAllServiceAgentAccess: false,
+          },
+        };
+        const [meta] = await ipFilterBucket.setMetadata(metadata);
+        assert.deepStrictEqual(meta.ipFilter, metadata.ipFilter);
+      });
+
+      it('should get ipFilter', async () => {
+        const [meta] = await ipFilterBucket.getMetadata();
+        assert.strictEqual(meta.ipFilter?.mode, 'Disabled');
+        assert.deepStrictEqual(
+          meta.ipFilter?.publicNetworkSource?.allowedIpCidrRanges,
+          ['0.0.0.0/0', '::/0']
+        );
+      });
+
+      it('should update ipFilter', async () => {
+        const metadata: BucketMetadata = {
+          ipFilter: {
+            mode: 'Disabled',
+            publicNetworkSource: {
+              allowedIpCidrRanges: ['203.0.113.0/24'],
+            },
+            allowAllServiceAgentAccess: false,
+          },
+        };
+        const [meta] = await ipFilterBucket.setMetadata(metadata);
+        assert.deepStrictEqual(meta.ipFilter, metadata.ipFilter);
+      });
+
+      it('should clear allowedIpCidrRanges', async () => {
+        const [getMeta] = await ipFilterBucket.getMetadata();
+        assert.strictEqual(getMeta.ipFilter?.mode, 'Disabled');
+        assert.deepStrictEqual(
+          getMeta.ipFilter?.publicNetworkSource?.allowedIpCidrRanges,
+          ['203.0.113.0/24']
+        );
+
+        const metadata: BucketMetadata = {
+          ipFilter: {
+            mode: 'Disabled',
+            publicNetworkSource: {
+              // The API omits the field when the array is cleared.
+              allowedIpCidrRanges: [],
+            },
+            allowAllServiceAgentAccess: false,
+          },
+        };
+        const [meta] = await ipFilterBucket.setMetadata(metadata);
+        assert.strictEqual(meta.ipFilter?.mode, 'Disabled');
+        assert.strictEqual(meta.ipFilter?.publicNetworkSource?.allowedIpCidrRanges, undefined);
+        assert.strictEqual(meta.ipFilter?.allowAllServiceAgentAccess, false);
+      });
+    });
+
     it('should allow setting metadata on a bucket', async () => {
       const metadata = {
         website: {
@@ -4608,7 +4704,15 @@ describe('storage', function () {
       setTimeout(resolve, RETENTION_DURATION_SECONDS * 1000),
     );
     return Promise.all(
-      buckets.map(bucket => limit(() => deleteBucketAsync(bucket))),
+      buckets.map(bucket =>
+        limit(() =>
+          deleteBucketAsync(bucket).catch((err: ApiError) => {
+            if (err.code !== 404) {
+              throw err;
+            }
+          })
+        )
+      )
     );
   }
 

handwritten/storage/test/bucket.ts

@@ -3714,5 +3714,185 @@ describe('Bucket', () => {
         bucket.setMetadata(clearMetadata, assert.ifError);
       });
     });
+
+    describe('ipFilter', () => {
+      it('should pass ipFilter to create', done => {
+        const metadata = {
+          ipFilter: {
+            mode: 'Disabled',
+            publicNetworkSource: {
+              allowedIpCidrRanges: ['192.168.0.0/16'],
+            },
+            allowAllServiceAgentAccess: true,
+          },
+        };
+
+        const storageMock = Object.assign({}, bucket.storage, {
+          createBucket: (
+            name: string,
+            options: unknown,
+            callback: Function
+          ) => {
+            assert.strictEqual(name, bucket.name);
+            assert.deepStrictEqual(options, metadata);
+            callback(null, bucket, metadata);
+          },
+        });
+
+        const testBucket = new Bucket(storageMock, bucket.name);
+        testBucket.create(metadata, (err: Error | null) => {
+          assert.ifError(err);
+          done();
+        });
+      });
+
+      it('should enable ipFilter', done => {
+        const metadata = {
+          ipFilter: {
+            mode: 'Enabled',
+            publicNetworkSource: {
+              allowedIpCidrRanges: ['192.168.1.1/32'],
+            },
+          },
+        };
+
+        bucket.parent.request = (
+          reqOpts: DecorateRequestOptions,
+          callback: Function
+        ) => {
+          assert.strictEqual(reqOpts.method, 'PATCH');
+          assert.deepStrictEqual(reqOpts.json.ipFilter, metadata.ipFilter);
+          callback(null, metadata);
+        };
+
+        bucket.setMetadata(metadata, (err: Error | null) => {
+          assert.ifError(err);
+          done();
+        });
+      });
+
+      it('should update ipFilter', done => {
+        const metadata = {
+          ipFilter: {
+            mode: 'Enabled',
+            vpcNetworkSources: [
+              {
+                network: 'projects/my-project/global/networks/my-vpc',
+                allowedIpCidrRanges: ['10.0.0.0/8'],
+              },
+            ],
+          },
+        };
+
+        bucket.parent.request = (
+          reqOpts: DecorateRequestOptions,
+          callback: Function
+        ) => {
+          assert.strictEqual(reqOpts.method, 'PATCH');
+          assert.deepStrictEqual(reqOpts.json.ipFilter, metadata.ipFilter);
+          callback(null, metadata);
+        };
+
+        bucket.setMetadata(metadata, (err: Error | null) => {
+          assert.ifError(err);
+          done();
+        });
+      });
+
+      it('should get ipFilter', async () => {
+        const ipFilter = {
+          mode: 'Enabled',
+          publicNetworkSource: {
+            allowedIpCidrRanges: ['192.168.1.1/32'],
+          },
+          vpcNetworkSources: [
+            {
+              network: 'projects/my-project/global/networks/my-vpc',
+              allowedIpCidrRanges: ['10.0.0.0/8'],
+            },
+          ],
+          allowAllServiceAgentAccess: true,
+          allowCrossOrgVpcs: true,
+        };
+
+        bucket.parent.request = (
+          reqOpts: DecorateRequestOptions,
+          callback: Function
+        ) => {
+          callback(null, {ipFilter});
+        };
+
+        const [metadata] = (await bucket.getMetadata()) as [BucketMetadata];
+        assert.deepStrictEqual(metadata.ipFilter, ipFilter);
+      });
+
+      it('should clear allowedIpCidrRanges', done => {
+        const initialIpFilter = {
+          mode: 'Disabled',
+          publicNetworkSource: {
+            allowedIpCidrRanges: ['203.0.113.0/24'],
+          },
+        };
+
+        const updatedIpFilter = {
+          mode: 'Disabled',
+          publicNetworkSource: {
+            allowedIpCidrRanges: undefined,
+          },
+          allowAllServiceAgentAccess: false,
+        };
+
+        bucket.parent.request = (
+          reqOpts: DecorateRequestOptions,
+          callback: Function
+        ) => {
+          if (reqOpts.method === 'PATCH') {
+            assert.deepStrictEqual(
+              reqOpts.json.ipFilter?.publicNetworkSource?.allowedIpCidrRanges,
+              []
+            );
+            callback(null, {ipFilter: updatedIpFilter});
+          } else {
+            callback(null, {ipFilter: initialIpFilter});
+          }
+        };
+
+        bucket.getMetadata((err: Error | null, getMeta?: BucketMetadata) => {
+          assert.ifError(err);
+          assert.strictEqual(getMeta?.ipFilter?.mode, 'Disabled');
+          assert.deepStrictEqual(
+            getMeta?.ipFilter?.publicNetworkSource?.allowedIpCidrRanges,
+            ['203.0.113.0/24']
+          );
+
+          const metadataUpdate = {
+            ipFilter: {
+              mode: 'Disabled',
+              publicNetworkSource: {
+                allowedIpCidrRanges: [],
+              },
+              allowAllServiceAgentAccess: false,
+            },
+          };
+
+          bucket.setMetadata(
+            metadataUpdate,
+            (err: Error | null, meta?: BucketMetadata) => {
+              assert.ifError(err);
+              assert.strictEqual(meta?.ipFilter?.mode, 'Disabled');
+              assert.strictEqual(
+                meta?.ipFilter?.publicNetworkSource?.allowedIpCidrRanges,
+                undefined
+              );
+              assert.strictEqual(
+                meta?.ipFilter?.allowAllServiceAgentAccess,
+                false
+              );
+              done();
+            }
+          );
+        });
+      });
+    });
   });
 });