Accessing objects in hosted storage

A method performed by one or more processors, the method comprising:nstoring, in a hosted storage system and in association with a storage structure, a first access control list, the first access control list designed to include (i) a control for granting permission to write data objects, each data object including respective metadata and contents, to the storage structure and (ii) a control for granting permission to read metadata of data objects from the storage structure, but designed not to include a control for granting permission to read contents of data objects from the storage structure, wherein the first access control list grants a first user permission to write data objects to the storage structure, and wherein a write operation to write a data object does not include reading contents of the data object stored at the storage structure before writing the data object;storing, in the hosted storage system and in association with a first data object stored in the storage structure, a second access control list, the second access control list designed to include a control for granting permission to read contents of the first data object, wherein the second access control list grants a second user permission to read the contents of the first data object;receiving, at the hosted storage system, a write request associated with the first user to write a second data object to the storage structure;determining, in response to receiving the write request and based on the first access control list, that the first user is permitted to write data objects to the storage structure;storing the second data object in the storage structure in response to determining the first user is permitted to write data objects to the storage structure;receiving, at the hosted storage system, a read request from the second user to read the contents of the first data object from the storage structure;determining, in response to receiving the read request and based on the second access control list, that the second user is permitted to read the contents of the first data object; andproviding the contents of the first data object to the second user in response to determining the second user is permitted to read the contents of the first data object.

A computer system comprising:na hosted storage system configured to:nstore, in the hosted storage system and in association with a storage structure, a first access control list, the first access control list designed to include (i) a control for granting permission to write data objects, each data object including respective metadata and contents, to the storage structure and (ii) a control for granting permission to read metadata of data objects from the storage structure, but designed not to include a control for granting permission to read contents of data objects from the storage structure, wherein the first access control list grants permission a first user permission to write data objects to the storage structure, and wherein a write operation to write a data object does not include reading contents of the data object stored at the storage structure before writing the data object;store, in the hosted storage system and in association with a first data object stored in the storage structure, a second access control list, the second access control list designed to include a control for granting permission to read contents of the first data object, wherein the second access control list grants a second user permission to read the contents of the first data object;receive, at the hosted storage system, a write request associated with the first user to write a second data object to the storage structure;determine, in response to receiving the write request and based on the first access control list, that the first user is permitted to write data objects to the storage structure;store the second data object in the storage structure in response to determining the first user is permitted to write data objects to the storage structure;receive, at the hosted storage system, a read request from the second user to read the contents of the first data object from the storage structure;determine, in response to receiving the read request and based on the second access control list, that the second user is permitted to read the contents of the first data object; andprovide the contents of the first data object to the second user in response to determining the second user is permitted to read the contents of the first data object.

A non-transitory computer readable medium storing instructions that, when executed by one or more processing devices, cause the one or more processing devices to perform operations including:nstoring, in a hosted storage system and in association with a storage structure, a first access control list, the first access control list designed to include (i) a control for granting permission to write data objects, each data object including respective metadata and contents, to the storage structure and (ii) a control for granting permission to read metadata of data objects from the storage structure, but designed not to include a control for granting permission to read contents of data objects from the storage structure, wherein the first access control list grants a first user permission to write data objects to the storage structure, and wherein a write operation to write a data object does not include reading contents of the data object stored at the storage structure before writing the data object;storing, in the hosted storage system and in association with a first data object stored in the storage structure, a second access control list, the second access control list designed to include a control for granting permission to read contents of the first data object, wherein the second access control list grants a second user permission to read the contents of the first data object;receiving, at the hosted storage system, a write request from the first user to write a second data object to the storage structure;determining, in response to receiving the write request and based on the first access control list, that the first user is permitted to write data objects to the storage structure;storing the second data object in the storage structure in response to determining the first user is permitted to write data objects to the storage structure;receiving, at the hosted storage system, a read request from the second user to read the contents of the first data object from the storage structure;determining, in response to receiving the read request and based on the second access control list, that the second user is permitted to read the contents of the first data object; andproviding the contents of the first data object to the second user in response to determining the second user is permitted to read the contents of the first data object.