using op_generator = RGWOp* (*)(const bufferlist&);

works for gcc and clang in godbolt: https://godbolt.org/z/YGhT3z4xK

it failed with "typedef", let me try "using".

i have to be explicit with the return types of the lambdas

@yuvalif : can you help me understand why the check for CreateBucket/ListAllMyBuckets has been removed?

@pritha-srivastava after my changes, we reach this line when we do bucket list, and return false.
why did we add this "if" statement i nthe first place?

@yuvalif : iirc, I added that because if a user tries to create a bucket/ list all buckets and there wasn't any policy (user policy, or role policy or session policy) for the same, or the policy didn't have any action to allow these s3 ops, then the code would go to the last statement and return false and these ops would be denied, which shouldn't be. I added the check as part of this commit: acee911

before my change, the code was doing the check only for bucket creation and listing all buckets.
so, for these operations nothing will change.
the change is that the chek will be done for other operation.

But for other iam ops (like create oidc provider etc) the ops must be allowed only based on the evaluation of the policies and in the absence of these policies, the op must be denied.

ok. so in the "common" function I should just return "false" if there is no policy?
and add the policy-less check to the verify_permission() of s3CreateBucket and s3ListAllMyBuckets ?

actually if verify_user_permission() returns false we wouldn't know whether its an actual 'deny' or simply because the policies don't exist or the policy doesn't have an action for these ops. So a better option would be to change the return type of the current verify_user_permission() to reflect the return type of policy evaluation, and then have a wrapper verify_user_permission with return type bool, that can invoke this new verify_user_permission. In this case we can move the extra 'if' check part to CreateBucket and ListAllMyBuckets verify_permission().

Policy is not mandatory in this case, a user with admin caps for oidc-provider can create an openidconnect provider in rgw.

so, for the OIDC ops with no policy, we should run verify_user_permission_no_policy() and not fail immediatly?
this is not what the code initally did.

No, for OIDC ops we do not need to go to verify_user_permission_no_policy(). Is it not possible to invoke verify_user_permission_no_policy() in CreateBucket/ListAllMyBuckets(), after policy evaluation is complete and the result is an Effect::Pass?