riak_test/tests/http_security.erl

-module(http_security).

-behavior(riak_test).
-export([confirm/0]).

-export([map_object_value/3, reduce_set_union/2, mapred_modfun_input/3]).

-include_lib("eunit/include/eunit.hrl").
-include_lib("riakc/include/riakc.hrl").

-define(assertDenied(Op), ?assertMatch({error, {forbidden, _}}, Op)).

confirm() ->
    application:start(crypto),
    application:start(asn1),
    application:start(public_key),
    application:start(ssl),
    application:start(ibrowse),
    io:format("turning on tracing"),
    ibrowse:trace_on(),

    CertDir = rt_config:get(rt_scratch_dir) ++ "/http_certs",

    %% make a bunch of crypto keys
    make_certs:rootCA(CertDir, "rootCA"),
    make_certs:endusers(CertDir, "rootCA", ["site3.basho.com", "site4.basho.com"]),


    lager:info("Deploy some nodes"),
    PrivDir = rt:priv_dir(),
    Conf = [
            {riak_core, [
                    {default_bucket_props, [{allow_mult, true}, {dvv_enabled, true}]},
                    {ssl, [
                            {certfile, filename:join([CertDir,
                                                      "site3.basho.com/cert.pem"])},
                            {keyfile, filename:join([CertDir,
                                                     "site3.basho.com/key.pem"])},
                            {cacertfile, filename:join([CertDir, "site3.basho.com/cacerts.pem"])}
                            ]}
                    ]},
             {riak_search, [
                     {enabled, true}
                    ]}
    ],
    Nodes = rt:build_cluster(4, Conf),
    Node = hd(Nodes),
    %% enable security on the cluster
    ok = rpc:call(Node, riak_core_console, security_enable, [[]]),
    enable_ssl(Node),
    %%[enable_ssl(N) || N <- Nodes],
    {ok, [{IP0, Port0}]} = rpc:call(Node, application, get_env,
                                    [riak_api, http]),
    {ok, [{IP, Port}]} = rpc:call(Node, application, get_env,
                                  [riak_api, https]),

    MD = riak_test_runner:metadata(),
    HaveIndexes = case proplists:get_value(backend, MD) of
                      undefined -> false; %% default is da 'cask
                      bitcask -> false;
                      _ -> true
                  end,

    lager:info("Checking non-SSL results in error"),
    %% connections over regular HTTP get told to go elsewhere
    C0 = rhc:create(IP0, Port0, "riak", []),
    ?assertMatch({error, {ok, "426", _, _}}, rhc:ping(C0)),

    lager:info("Checking SSL demands authentication"),
    C1 = rhc:create(IP, Port, "riak", [{is_ssl, true}]),
    ?assertMatch({error, {ok, "401", _, _}}, rhc:ping(C1)),

    lager:info("Checking that unknown user demands reauth"),
    C2 = rhc:create(IP, Port, "riak", [{is_ssl, true}, {credentials,
                                                        "user",
                                                        "pass"}]),
    ?assertMatch({error, {ok, "401", _, _}}, rhc:ping(C2)),

    %% Store this in a variable so once Riak supports utf-8 usernames
    %% via HTTP(s) we can test it with just one change
    Username = "user",

    lager:info("Creating user"),
    %% grant the user credentials
    ok = rpc:call(Node, riak_core_console, add_user, [[Username, "password=password"]]),

    lager:info("Setting trust mode on user"),
    %% trust anyone from this host
    MyIP = case IP0 of
               "127.0.0.1" -> IP0;
               _ ->
                   {ok,Hostname} = inet:gethostname(),
                   {ok,A0} = inet:getaddr(Hostname, inet),
                   inet:ntoa(A0)
           end,
    ok = rpc:call(Node, riak_core_console, add_source, [[Username,
                                                         MyIP++"/32",
                                                         "trust"]]),

    lager:info("Checking that credentials are ignored in trust mode"),
    %% invalid credentials should be ignored in trust mode
    C3 = rhc:create(IP, Port, "riak", [{is_ssl, true}, {credentials,
                                                        Username,
                                                        "pass"}]),
    ?assertEqual(ok, rhc:ping(C3)),

    lager:info("Setting password mode on user"),
    %% require password from our IP
    ok = rpc:call(Node, riak_core_console, add_source, [[Username,
                                                         MyIP++"/32",
                                                         "password"]]),

    lager:info("Checking that incorrect password demands reauth"),
    %% invalid credentials should be rejected in password mode
    C4 = rhc:create(IP, Port, "riak", [{is_ssl, true}, {credentials,
                                                        Username,
                                                        "pass"}]),
    ?assertMatch({error, {ok, "401", _, _}}, rhc:ping(C4)),

    lager:info("Checking that correct password is successful"),
    %% valid credentials should be accepted in password mode
    C5 = rhc:create(IP, Port, "riak", [{is_ssl, true}, {credentials,
                                                        Username,
                                                        "password"}]),

    ?assertEqual(ok, rhc:ping(C5)),

    lager:info("verifying the peer certificate rejects mismatch with server cert"),
    %% verifying the peer certificate reject mismatch with server cert
    C6 = rhc:create(IP, Port, "riak", [{is_ssl, true},
                                       {credentials, Username, "password"},
                                       {ssl_options, [
                        {cacertfile, filename:join([PrivDir,
                                                    "certs/cacert.org/ca/root.crt"])},
                        {verify, verify_peer},
                        {reuse_sessions, false}
                        ]}
                                               ]),

    ?assertMatch({error,{conn_failed,{error,_}}}, rhc:ping(C6)),

    lager:info("verifying the peer certificate should work if the cert is valid"),
    %% verifying the peer certificate should work if the cert is valid
    C7 = rhc:create(IP, Port, "riak", [{is_ssl, true},
                                       {credentials, Username, "password"},
                                       {ssl_options, [
                        {cacertfile, filename:join([CertDir,
                                                    "rootCA/cert.pem"])},
                        {verify, verify_peer},
                        {reuse_sessions, false}
                        ]}
                                      ]),

    ?assertEqual(ok, rhc:ping(C7)),

    lager:info("verifying that user cannot get/put without grants"),
    ?assertMatch({error, {ok, "403", _, _}}, rhc:get(C7, <<"hello">>,
                                                     <<"world">>)),

    Object = riakc_obj:new(<<"hello">>, <<"world">>, <<"howareyou">>,
                           <<"text/plain">>),

    ?assertMatch({error, {ok, "403", _, _}}, rhc:put(C7, Object)),

    lager:info("Granting riak_kv.get, checking get works but put doesn't"),
    ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.get", "on",
                                                    "default", "hello", "to", Username]]),

    %% key is not present
    ?assertMatch({error, notfound}, rhc:get(C7, <<"hello">>,
                                                     <<"world">>)),

    ?assertMatch({error, {ok, "403", _, _}}, rhc:put(C7, Object)),

    lager:info("Granting riak_kv.put, checking put works and roundtrips with get"),
    ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.put", "on",
                                                    "default", "hello", "to", Username]]),

    %% NOW we can put
    ?assertEqual(ok, rhc:put(C7, Object)),

    {ok, O} = rhc:get(C7, <<"hello">>, <<"world">>),
    ?assertEqual(<<"hello">>, riakc_obj:bucket(O)),
    ?assertEqual(<<"world">>, riakc_obj:key(O)),
    ?assertEqual(<<"howareyou">>, riakc_obj:get_value(O)),

    lager:info("Checking that delete is disallowed"),
    %% delete
    ?assertMatch({error, {ok, "403", _, _}}, rhc:delete(C7, <<"hello">>,
                                                        <<"world">>)),

    lager:info("Checking that delete for non-existing key is disallowed"),
    ?assertMatch({error, {ok, "403", _, _}}, rhc:delete(C7, <<"hello">>,
                                                        <<"_xxboguskey">>)),

    lager:info("Granting riak_kv.delete, checking that delete succeeds"),
    ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.delete", "on",
                                                    "default", "hello", "to", Username]]),
    ?assertEqual(ok, rhc:delete(C7, <<"hello">>,
                                <<"world">>)),

    %% key is deleted
    ?assertMatch({error, notfound}, rhc:get(C7, <<"hello">>,
                                                     <<"world">>)),

    %% write it back for list_buckets later
    ?assertEqual(ok, rhc:put(C7, Object)),

    lager:info("Checking that delete for non-existing key is allowed"),
    ?assertMatch({error, {ok, "404", _, _}}, rhc:delete(C7, <<"hello">>,
                                                        <<"_xxboguskey">>)),


    %% slam the door in the user's face
    lager:info("Revoking get/put/delete, checking that get/put/delete are disallowed"),
    ok = rpc:call(Node, riak_core_console, revoke,
                  [["riak_kv.put,riak_kv.get,riak_kv.delete", "on",
                    "default", "hello", "from", Username]]),

    ?assertMatch({error, {ok, "403", _, _}}, rhc:get(C7, <<"hello">>,
                                                     <<"world">>)),

    ?assertMatch({error, {ok, "403", _, _}}, rhc:put(C7, Object)),

    %% list buckets
    lager:info("Checking that list buckets is disallowed"),
    ?assertMatch({error, {"403", _}}, rhc:list_buckets(C7)),

    lager:info("Granting riak_kv.list_buckets, checking that list_buckets succeeds"),
    ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.list_buckets", "on",
                                                    "default", "to", Username]]),
    ?assertMatch({ok, [<<"hello">>]}, rhc:list_buckets(C7)),

    %% list keys
    lager:info("Checking that list keys is disallowed"),
    ?assertMatch({error, {"403", _}}, rhc:list_keys(C7, <<"hello">>)),

    lager:info("Granting riak_kv.list_keys, checking that list_keys succeeds"),
    ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.list_keys", "on",
                                                    "default", "to", Username]]),

    ?assertMatch({ok, [<<"world">>]}, rhc:list_keys(C7, <<"hello">>)),

    lager:info("Revoking list_keys"),
    ok = rpc:call(Node, riak_core_console, revoke, [["riak_kv.list_keys", "on",
                                                    "default", "from", Username]]),

    %% list keys with bucket type
    rt:create_and_activate_bucket_type(Node, <<"list-keys-test">>, []),

    lager:info("Checking that list keys on a bucket-type is disallowed"),
    ?assertMatch({error, {"403", _}}, rhc:list_keys(C7, {<<"list-keys-test">>, <<"hello">>})),

    lager:info("Granting riak_kv.list_keys on the bucket type, checking that list_keys succeeds"),
    ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.list_keys", "on",
                                                    "list-keys-test", "to", Username]]),
    ?assertMatch({ok, []}, rhc:list_keys(C7, {<<"list-keys-test">>, <<"hello">>})),

    lager:info("Checking that get_bucket is disallowed"),
    ?assertMatch({error, {ok, "403", _, _}}, rhc:get_bucket(C7, <<"hello">>)),

    lager:info("Granting riak_core.get_bucket, checking that get_bucket succeeds"),
    ok = rpc:call(Node, riak_core_console, grant, [["riak_core.get_bucket", "on",
                                                    "default", "hello", "to", Username]]),

    ?assertEqual(3, proplists:get_value(n_val, element(2, rhc:get_bucket(C7,
                                                                         <<"hello">>)))),

    lager:info("Checking that reset_bucket is disallowed"),
    ?assertMatch({error, {ok, "403", _, _}}, rhc:reset_bucket(C7, <<"hello">>)),

    lager:info("Checking that set_bucket is disallowed"),
    ?assertMatch({error, {ok, "403", _, _}}, rhc:set_bucket(C7, <<"hello">>,
                                                            [{n_val, 5}])),

    lager:info("Granting set_bucket, checking that set_bucket succeeds"),
    ok = rpc:call(Node, riak_core_console, grant, [["riak_core.set_bucket", "on",
                                                    "default", "hello", "to", Username]]),

    ?assertEqual(ok, rhc:set_bucket(C7, <<"hello">>,
                                    [{n_val, 5}])),

    ?assertEqual(5, proplists:get_value(n_val, element(2, rhc:get_bucket(C7,
                                                                         <<"hello">>)))),

    %% 2i
    case HaveIndexes of
        false -> ok;
        true ->
            %% 2i permission test
            lager:info("Checking 2i is disallowed"),
            ?assertMatch({error, {"403", _}},
                         rhc:get_index(C7, <<"hello">>,
                                                   {binary_index,
                                                    "name"},
                                                   <<"John">>)),

            lager:info("Granting 2i permissions, checking that results come back"),
            ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.index", "on",
                                                            "default", "to", Username]]),

            %% don't actually have any indexes
            ?assertMatch({ok, ?INDEX_RESULTS{}},
                         rhc:get_index(C7, <<"hello">>,
                                                   {binary_index,
                                                    "name"},
                                                   <<"John">>)),

            lager:info("Checking that 2i on a bucket-type is disallowed"),
            ?assertMatch({error, {"403", _}},
                         rhc:get_index(C7, {<<"list-keys-test">>,
                                            <<"hello">>}, {binary_index, "name"}, <<"John">>)),

            lager:info("Granting riak_kv.index on the bucket type, checking that get_index succeeds"),
            ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.index", "on",
                                                    "list-keys-test", "to", Username]]),
            ?assertMatch({ok, ?INDEX_RESULTS{}},
                         rhc:get_index(C7, {<<"list-keys-test">>,
                                            <<"hello">>}, {binary_index, "name"}, <<"John">>)),

            ok
    end,

    %% counters

    %% grant get/put again
    lager:info("Granting get/put for counters, checking value and increment"),
    ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.get,riak_kv.put", "on",
                                                    "default", "hello", "to", Username]]),


    ?assertMatch({error, {ok, "404", _, _}}, rhc:counter_val(C7, <<"hello">>,
                                                    <<"numberofpies">>)),

    ok = rhc:counter_incr(C7, <<"hello">>,
                          <<"numberofpies">>, 5),

    ?assertEqual({ok, 5}, rhc:counter_val(C7, <<"hello">>,
                                          <<"numberofpies">>)),

    %% revoke get
    lager:info("Revoking get, checking that value fails but increment succeeds"),
    ok = rpc:call(Node, riak_core_console, revoke,
                  [["riak_kv.get", "on", "default", "hello", "from", Username]]),

    ?assertMatch({error, {ok, "403", _, _}}, rhc:counter_val(C7, <<"hello">>,
                                          <<"numberofpies">>)),
    ok = rhc:counter_incr(C7, <<"hello">>,
                          <<"numberofpies">>, 5),

    %% revoke put
    lager:info("Revoking put, checking that increment fails"),
    ok = rpc:call(Node, riak_core_console, revoke,
                  [["riak_kv.put", "on", "default", "hello", "from", Username]]),

    ?assertMatch({error, {ok, "403", _, _}}, rhc:counter_incr(C7, <<"hello">>,
                          <<"numberofpies">>, 5)),

    %% mapred tests
    lager:info("Checking that full-bucket mapred is disallowed"),
    ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.put", "on",
                                                    "default", "MR", "to", Username]]),


    ok = rhc:put(C7, riakc_obj:new(<<"MR">>, <<"lobster_roll">>, <<"16">>,
                           <<"text/plain">>)),

    ok = rhc:put(C7, riakc_obj:new(<<"MR">>, <<"pickle_plate">>, <<"9">>,
                           <<"text/plain">>)),

    ok = rhc:put(C7, riakc_obj:new(<<"MR">>, <<"pimms_cup">>, <<"8">>,
                           <<"text/plain">>)),

    ?assertMatch({error, {"403", _}},
                 rhc:mapred_bucket(C7, <<"MR">>, [{map, {jsfun,
                                                     <<"Riak.mapValuesJson">>}, undefined, false},
                                              {reduce, {jsfun,
                                                        <<"Riak.reduceSum">>}, undefined,
                                               true}])),

    lager:info("Granting list-keys, asserting full-bucket mapred is still disallowed"),
    ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.list_keys", "on",
                                                    "default", "MR", "to", Username]]),

    ?assertMatch({error, {"403", _}},
                 rhc:mapred_bucket(C7, <<"MR">>, [{map, {jsfun,
                                                     <<"Riak.mapValuesJson">>}, undefined, false},
                                              {reduce, {jsfun,
                                                        <<"Riak.reduceSum">>}, undefined,
                                               true}])),

    lager:info("Granting mapreduce, checking that job succeeds"),
    ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.mapreduce", "on",
                                                    "default", "MR", "to", Username]]),

    ?assertEqual({ok, [{1, [33]}]},
                 rhc:mapred_bucket(C7, <<"MR">>, [{map, {jsfun,
                                                     <<"Riak.mapValuesJson">>}, undefined, false},
                                              {reduce, {jsfun,
                                                        <<"Riak.reduceSum">>}, undefined,
                                               true}])),

    %% load this module on all the nodes
    ok = rt:load_modules_on_nodes([?MODULE], Nodes),

    lager:info("checking erlang mapreduce works"),
    ?assertMatch({ok, [{1, _}]},
                 rhc:mapred_bucket(C7, <<"MR">>, [{map, {modfun,
                                                     riak_kv_mapreduce,
                                                        map_object_value}, undefined, false},
                                              {reduce, {modfun,
                                                        riak_kv_mapreduce,
                                                       reduce_set_union}, undefined,
                                               true}])),

    lager:info("checking that insecure input modfun fails"),
    ?assertMatch({error, _},
                 rhc:mapred_bucket(C7, {modfun, ?MODULE, mapred_modfun_input,
                                        []}, [{map, {modfun,
                                                     riak_kv_mapreduce,
                                                        map_object_value}, undefined, false},
                                              {reduce, {modfun,
                                                        riak_kv_mapreduce,
                                                       reduce_set_union}, undefined,
                                               true}])),

    lager:info("checking that insecure query modfuns fail"),
    ?assertMatch({error, _},
                 rhc:mapred_bucket(C7, <<"MR">>, [{map, {modfun,
                                                     ?MODULE,
                                                        map_object_value}, undefined, false},
                                              {reduce, {modfun,
                                                        ?MODULE,
                                                       reduce_set_union}, undefined,
                                               true}])),

    lager:info("whitelisting module path"),
    {?MODULE, _ModBin, ModFile} = code:get_object_code(?MODULE),
    ok = rpc:call(Node, application, set_env, [riak_kv, add_paths, [filename:dirname(ModFile)]]),

    lager:info("checking that insecure input modfun fails when whitelisted but"
               " lacking permissions"),
    ?assertMatch({error, {"403", _}},
                 rhc:mapred_bucket(C7, {modfun, ?MODULE, mapred_modfun_input,
                                        []}, [{map, {modfun,
                                                     riak_kv_mapreduce,
                                                        map_object_value}, undefined, false},
                                              {reduce, {modfun,
                                                        riak_kv_mapreduce,
                                                       reduce_set_union}, undefined,
                                               true}])),

    ok = rpc:call(Node, riak_core_console, grant, [["riak_kv.mapreduce", "on",
                                                    "any", "to", Username]]),

    lager:info("checking that insecure input modfun works when whitelisted and"
               " has permissions"),
    ?assertMatch({ok, _},
                 rhc:mapred_bucket(C7, {modfun, ?MODULE, mapred_modfun_input,
                                        []}, [{map, {modfun,
                                                     riak_kv_mapreduce,
                                                        map_object_value}, undefined, false},
                                              {reduce, {modfun,
                                                        riak_kv_mapreduce,
                                                       reduce_set_union}, undefined,
                                               true}])),

    ok = rpc:call(Node, riak_core_console, revoke, [["riak_kv.mapreduce", "on",
                                                    "any", "from", Username]]),

    lager:info("checking that insecure query modfuns works when whitelisted"),
    ?assertMatch({ok, _},
                 rhc:mapred_bucket(C7, <<"MR">>, [{map, {modfun,
                                                     ?MODULE,
                                                        map_object_value}, undefined, false},
                                              {reduce, {modfun,
                                                        ?MODULE,
                                                       reduce_set_union}, undefined,
                                               true}])),


    lager:info("Revoking list-keys, checking that full-bucket mapred fails"),
    ok = rpc:call(Node, riak_core_console, revoke, [["riak_kv.list_keys", "on",
                                                    "default", "MR", "from", Username]]),

    ?assertMatch({error, {"403", _}},
                 rhc:mapred_bucket(C7, <<"MR">>, [{map, {jsfun,
                                                     <<"Riak.mapValuesJson">>}, undefined, false},
                                              {reduce, {jsfun,
                                                        <<"Riak.reduceSum">>}, undefined,
                                               true}])),

    crdt_tests(Nodes, C7),

    URL = lists:flatten(io_lib:format("https://~s:~b", [IP, Port])),

    lager:info("checking link walking fails because it is deprecated"),

    ?assertMatch({ok, "403", _, <<"Link walking is deprecated", _/binary>>},
                       ibrowse:send_req(URL ++ "/riak/hb/first/_,_,_", [], get,
                     [], [{response_format, binary}, {is_ssl, true},
                          {ssl_options, [
                                         {cacertfile, filename:join([CertDir,
                                                                     "rootCA/cert.pem"])},
                                         {verify, verify_peer},
                                         {reuse_sessions, false}]}])),

    lager:info("checking search 1.0 403s because search won't allow"
               "connections with security enabled"),

    ?assertMatch({ok, "403", _, <<"Riak Search 1.0 is deprecated", _/binary>>},
                       ibrowse:send_req(URL ++ "/solr/index/select?q=foo:bar&wt=json", [], get,
                     [], [{response_format, binary}, {is_ssl, true},
                          {ssl_options, [
                                         {cacertfile, filename:join([CertDir,
                                                                     "rootCA/cert.pem"])},
                                         {verify, verify_peer},
                                         {reuse_sessions, false}]}])),
    pass.

enable_ssl(Node) ->
    [{http, {IP, Port}}|_] = rt:connection_info(Node),
    rt:update_app_config(Node, [{riak_api, [{https, [{IP,
                                                      Port+1000}]}]}]),
    rt:wait_until_pingable(Node),
    rt:wait_for_service(Node, riak_kv).

map_object_value(RiakObject, A, B) ->
    riak_kv_mapreduce:map_object_value(RiakObject, A, B).

reduce_set_union(List, A) ->
    riak_kv_mapreduce:reduce_set_union(List, A).

mapred_modfun_input(Pipe, _Args, _Timeout) ->
    riak_pipe:queue_work(Pipe, {{<<"MR">>, <<"lobster_roll">>}, {struct, []}}),
    riak_pipe:eoi(Pipe).

crdt_tests([Node|_]=Nodes, RHC) ->
    Username = "user",

    lager:info("Creating bucket types for CRDTs"),
    Types = [{<<"counters">>, counter, riakc_counter:to_op(riakc_counter:increment(5, riakc_counter:new()))},
             {<<"sets">>, set, riakc_set:to_op(riakc_set:add_element(<<"foo">>, riakc_set:new()))}],
    [ begin
          rt:create_and_activate_bucket_type(Node, BType, [{allow_mult, true}, {datatype, DType}]),
          rt:wait_until_bucket_type_status(BType, active, Nodes),
          rt:wait_until_bucket_type_visible(Nodes, BType)
      end || {BType, DType, _Op} <- Types ],

    lager:info("Checking that CRDT fetch is denied"),

    [ ?assertDenied(rhc:fetch_type(RHC, {BType, <<"bucket">>}, <<"key">>))
     ||  {BType, _, _} <- Types],

    lager:info("Granting CRDT riak_kv.get, checking that fetches succeed"),

    [ grant(Node, ["riak_kv.get", "on", binary_to_list(Type), "to", Username]) || {Type, _, _} <- Types ],

    [ ?assertEqual({error, {notfound, DType}},
                  (rhc:fetch_type(RHC, {BType, <<"bucket">>}, <<"key">>))) ||
          {BType, DType, _, _} <- Types],

    lager:info("Checking that CRDT update is denied"),

    [ ?assertDenied(rhc:update_type(RHC, {BType, <<"bucket">>}, <<"key">>, Op))
     ||  {BType, _, Op} <- Types],


    lager:info("Granting CRDT riak_kv.put, checking that updates succeed"),

    [ grant(Node, ["riak_kv.put", "on", binary_to_list(Type), "to", Username]) || {Type, _, _} <- Types ],

    [?assertEqual(ok, (rhc:update_type(RHC, {BType, <<"bucket">>}, <<"key">>, Op)))
     ||  {BType, _, Op} <- Types],

    ok.

grant(Node, Args) ->
    ok = rpc:call(Node, riak_core_console, grant, [Args]).