Set the correct ACL on google storage - google-app-engine

Question

We have created two microservices, one which uploads images to Google storage (bucket) from node.js. And service which returns the serving_url from a python service. Both services work. Almost...
Our problem is that if we don't have the correct ACL on a file in the bucket, we are not allowed to get the serving_url() from the image service.
We are uploading images from the frontend with a resumable upload link, generated in the node.js file service:
createResumeableUpload: async (filename, metadata) => {
const file = await bucket.file(filename);
const upload = await file.createResumableUpload({
metadata,
public: true,
});
return upload;
},
After inspecting the file in the bucket, we do get allUsers with reader permissions, see the image below. But the transformation on the image-service will throw an exception, due to invalid permissions.
If we, however, upload an image directly in the bucket interface we get some more permissions, and after some testing, we found the following permission is what we are looking for is the editors, the second in the list:
We have tried a lot both setting the ACL when we create the resumable upload or on the file after creating it, but nothing works. We would really appreciate if someone could help us how to set the correct ACL on the file, so we are able to get the serving_url() from the image service.
[EDIT]
To answer some of the questions. We are 100 % certain this is a permission issue, the image service is working fine if we add the editor's permission, but we need to be able to add this permission when we add images to the bucket. And this is my question:
How do we add the owner permission to editors, when we upload images to the buckets from our node.js service?

Answer 1

Images API uses App Engine default service account (YOUR_PROJECT_ID#appspot.gserviceaccount.com). This service account does not need to be project owner for get_serving_url() to work as long as you grant it Storage Object Admin role on the bucket. Alternatively you can update object ACLs granting object owner to the service account.

Answer 2

In order to add the necessary permissions, you can send a patch request to the JSON API with a JSON that defines all ACLs you wish the object to have.
UPDATE:
A feature request has been created on your behalf to make this functionality available for the NodeJS client library. Please star it so that you could receive updates about this feature request and do not hesitate to add additional comments to provide details of the desired implementation. You can track the feature request by following this link.

Answer 3

After many hours of trying figure Google ACL system, I would like to share how I was able to setup ACL from nodejs.
After an image file is uploaded to the bucket, it needs to have the project owner ACL added. If this the image file does not have the project owner ACL, it will throw an exception when generating the serving_url().
To update ACL I used this function:
updateAcl: async (name: string) => {
const file = await bucket.file(name);
console.log('file', file);
const acl = await file.acl.add({
role: 'OWNER',
entity: 'project-editors-231929353801'
});
return acl;
}
From the storage panel, it's possible to get a list of all the default ACLs.