web: Remove bucket policy when we have no more statements. (#2779)

cmd/web-handlers.go

@@ -614,6 +614,7 @@ func (web *webAPIHandlers) ListAllBucketPolicies(r *http.Request, args *ListAllB
 	}
 
 	reply.UIVersion = miniobrowser.UIVersion
+	reply.Policies = []bucketAccessPolicy{}
 	for prefix, policy := range policy.GetPolicies(policyInfo.Statements, args.BucketName) {
 		reply.Policies = append(reply.Policies, bucketAccessPolicy{
 			Prefix: prefix,
@@ -650,6 +651,12 @@ func (web *webAPIHandlers) SetBucketPolicy(r *http.Request, args *SetBucketPolic
 		return &json2.Error{Message: err.Error()}
 	}
 	policyInfo.Statements = policy.SetPolicy(policyInfo.Statements, bucketP, args.BucketName, args.Prefix)
+	if len(policyInfo.Statements) == 0 {
+		if err = removeBucketPolicy(args.BucketName, objectAPI); err != nil {
+			return &json2.Error{Message: err.Error()}
+		}
+		return nil
+	}
 	data, err := json.Marshal(policyInfo)
 	if err != nil {
 		return &json2.Error{Message: err.Error()}

cmd/web-handlers_test.go

@@ -983,6 +983,10 @@ func testWebSetBucketPolicyHandler(obj ObjectLayer, instanceType string, t TestE
 		{bucketName, "", "foo", false},
 		// Valid parameters
 		{bucketName, "", "readwrite", true},
+		// None is valid and policy should be removed.
+		{bucketName, "", "none", true},
+		// Setting none again meants should return an error.
+		{bucketName, "", "none", false},
 	}
 
 	for i, testCase := range testCases {
@@ -995,7 +999,7 @@ func testWebSetBucketPolicyHandler(obj ObjectLayer, instanceType string, t TestE
 		}
 		apiRouter.ServeHTTP(rec, req)
 		// Check if we have 200 OK
-		if rec.Code != http.StatusOK {
+		if testCase.pass && rec.Code != http.StatusOK {
 			t.Fatalf("Test %d: Expected the response status to be 200, but instead found `%d`", i+1, rec.Code)
 		}
 		// Parse RPC response