From e931cccc7b75dd15526cd505d1c026463989400f Mon Sep 17 00:00:00 2001 From: Mathieu Arnold Date: Mon, 24 Aug 2026 07:11:18 +0200 Subject: [PATCH] Manage bucket policies via the admin ui (#10895) * admin: manage S3 bucket policies from the admin UI Bucket policies were only manageable through the S3 PutBucketPolicy API; the admin UI had no equivalent to the quota/owner/lifecycle editors it already offers. Add GET/PUT/DELETE for a bucket's policy, sharing the exact validation the S3 gateway uses. - Extract validateBucketPolicy/validateResourceForBucket out of s3api_bucket_policy_handlers.go into policy_engine.ValidateBucketPolicy / ResourceMatchesBucket so both the S3 API and the admin UI enforce identical rules. - weed/admin/dash/bucket_policy.go: Get/Set/DeleteBucketPolicy, writing through ObjectTransaction + PATCH_EXTENDED (the lifecycle pattern) so a concurrent owner/quota/lifecycle change on the same bucket entry isn't clobbered. Propagation to every S3 gateway is automatic via the existing filer metadata log subscription. The S3 gateway's IAM policy mirror is deliberately not replicated here (its delete path is already an unimplemented TODO on the S3 side). - New GET/PUT/DELETE /api/s3/buckets/{bucket}/policy routes, CSRF-guarded on writes. - Bucket list and details modal now show a statement-count badge, read from the entry already fetched (no extra RPC). - UI: a JSON-textarea policy editor modal, matching the lifecycle modal's structure. * admin: reuse the visual policy editor for bucket policies Extract the structured policy editor (add/remove statement, action/ resource/principal rows with autocomplete, JSON tab kept in sync) out of policies.templ's inline script into a shared weed/admin/static/js/policy_editor.js, and wire the bucket policy modal in s3_buckets.templ up to it instead of a bare JSON textarea. - registerPolicyEditor(which, config) replaces the hardcoded create/edit id derivation with a per-instance config (textarea/tab/body ids, datalist ids, requirePrincipal, bucket). The IAM policies page keeps its exact pre-extraction ids via two registerPolicyEditor calls, so its markup is unchanged. - New policy_datalists.templ exposes the three shared s (actions/resources/principals) as @PolicyDatalists(), now rendered by both policies.templ and s3_buckets.templ. - requirePrincipal seeds new bucket-policy statements with Principal: "*" and adds a client-side check before save (the server, via policy_engine.ValidateBucketPolicy, remains the actual authority); the bucket config pins the Resource autocomplete to the open bucket instead of fetching every bucket in the cluster. - layout.templ loads policy_editor.js globally, after admin.js/ modal-alerts.js (basePath/escapeHtml/showAlert) which it depends on. 3a (the extraction) is a byte-preserving move verified against the unchanged policies.templ behavior before layering 3b's parameterization and the bucket-policy wiring on top. * admin: migrate S3 Tables bucket/table policy editors to the shared editor Third consumer of the shared visual policy editor: the S3 Tables bucket and table policy modals (a bare JSON textarea each) now get the same structured Editor/JSON tabs as the bucket policy and IAM policy pages, via registerPolicyEditor('s3tablesBucketPolicy'/'s3tablesTablePolicy', { textareaId: ... }). Storage and validation are untouched - S3 Tables policies still go through their own s3tables.PolicyDocument type and the s3tables.policy extended attribute, unrelated to policy_engine and s3-bucket-policy; only the editor UI is shared. Fix a real bug surfaced by adding this second load path: the bucket policy modal (and the naive first draft of this s3tables port) called commitPolicyTextareaToEditor() right after a GET and then force-switched to the Editor tab. commitPolicyTextareaToEditor() is designed to leave the current tab in place and the editor state untouched when a document fails to parse (so an in-progress edit survives a bad tab switch), so forcing the Editor tab afterwards could show empty/stale editor state that a careless Save would then serialize over a perfectly valid but structurally-unusual stored policy. Add loadPolicyTextareaIntoEditor(which) to policy_editor.js, which has no "current tab" to defer to and instead falls back to the JSON tab with an alert on a document the structured editor can't represent - the same safety editPolicy already had in policies.templ - and use it at all three "populate the editor right after a GET" call sites (bucket policy, S3 Tables bucket policy, S3 Tables table policy). * admin: show policy statement count on the S3 Tables buckets page Mirrors the "Policy" column already added to the classic S3 buckets list: a clickable badge with the statement count when the table bucket has a resource policy, "Not configured" otherwise. S3 Tables policies are a separate mechanism (s3tables.PolicyDocument under the s3tables.policy extended attribute) from the S3 bucket policy work elsewhere in this branch (policy_engine.PolicyDocument / s3-bucket-policy), so this is a parallel implementation of the same pattern rather than shared code. - S3TablesBucketSummary gains PolicyStatementCount, populated in GetS3TablesBucketsData from entry.Entry.Extended[s3tables.ExtendedKeyPolicy] via the new extractS3TablesPolicyStatementCountFromEntry - no extra RPC, the entry is already fetched for ExtendedKeyMetadata. - The badge reuses the existing .s3tables-bucket-policy-btn class, so it opens the same policy modal as the row's action button with no JS changes. * admin: don't let a failed policy GET open the door to an empty overwrite loadS3TablesBucketPolicy/loadS3TablesTablePolicy cleared the textarea, then unconditionally called loadPolicyTextareaIntoEditor() regardless of whether the GET actually succeeded - including when fetch() rejected or the response was not ok, silently logged to console only. That leaves the structured editor holding a legitimate-looking empty policy ({version, statements: []}), with the Editor tab active by default. If Save is then clicked, commitPolicyActiveTab() serializes that empty state into the textarea as `{"Version":"2012-10-17","Statement":[]}` - a non-empty string - before the "Policy JSON is required" guard ever sees it, so the guard passes and the transient load failure gets written over whatever policy was actually stored. Add s3tablesBucketPolicyLoaded/s3tablesTablePolicyLoaded, set true only once a GET has actually completed (ok, including a genuinely empty policy) and false on any failure path (fetch rejection or a non-ok response, which previously fell through silently). Both submit handlers now check the flag before touching the editor at all, and a failed load surfaces via alert() instead of only a console.error - the user previously had no visible indication the load had failed. Verified with a jsdom simulation driving the real rendered page against a stubbed fetch: a failed GET followed by Save now sends no PUT at all (previously it sent Statement: []); a successful GET followed by Save still PUTs the loaded policy unchanged. * admin: address code review findings on the policy editor 1. policy_editor.js: policyEditors is only pre-populated for 'create'/ 'edit'; every other `which` (bucket, s3tablesBucket, s3tablesTable) stays undefined until its first successful async load. Nothing in this file enforces that a page hide its Editor/JSON tabs and Add-statement button until that load completes - the S3 Tables policy modals don't - so a click in that window (e.g. Add statement, or switching to the JSON tab) threw "Cannot read properties of undefined (reading 'unparsed')". Add policyEditorState(which), which lazily initializes a default state, and route addPolicyStatement, the jsonTabBtn 'show.bs.tab' handler, commitPolicyActiveTab, and renderPolicyEditor through it. Verified with a jsdom simulation against a never-resolving fetch: the exact click threw on the pre-fix code and no longer does. 2. s3_buckets.templ: the bucket-policy Save handler checked the textarea for emptiness before calling commitPolicyActiveTab(), which is what actually serializes the structured Editor tab's fields into that textarea. A policy entered entirely through the Editor tab (the primary path - never touching the JSON tab) left the textarea at whatever it was at load time, so creating a new policy this way hit "Enter a policy document" and Save silently did nothing. Move the commit before the emptiness check, preserving the existing alert and early-return. Verified with a jsdom simulation: Add-statement then Save (no tab switch) now PUTs the entered statement; before the fix the same sequence never reached fetch(). 3. s3tables_buckets.templ / s3tables_tables.templ: the policy Editor/ JSON nav-tabs were missing the ARIA roles Bootstrap's own tab pattern expects (role="tab"/"tabpanel", aria-selected, aria-controls, aria-labelledby) - screen readers had no way to tell these were tabs or which pane went with which button. Added the standard Bootstrap 5 tab markup to both. * admin: guard policy load/save flows against overlapping requests 1. s3tables.js: loadS3TablesBucketPolicy/loadS3TablesTablePolicy had no protection against overlapping loads. Opening one bucket's (or table's) policy dialog and then another's before the first GET resolved let the late response write its document into the shared textarea and mark the dialog "loaded" while it was now targeting the second resource - a subsequent Save would then push the first resource's policy onto the second. Add a per-load monotonic sequence number (s3tablesBucketPolicyRequestSeq / s3tablesTablePolicyRequestSeq, the same pattern already used for the classic bucket-policy load in s3_buckets.templ); a response is only applied - textarea, loaded flag, editor state - if its captured sequence still matches the latest one issued. Verified with a jsdom simulation: bucket A's policy load (artificially slow) followed immediately by bucket B's (fast) previously left A's policy in the textarea once A's late response landed; it now correctly keeps B's. 2. s3_buckets.templ: the bucket-policy Save button lives outside the (initially hidden) editor wrapper, so it stays clickable while a load is still in flight - the existing policyRequestSeq guard only protects the *load* from a stale response, not Save from firing before any load for the current bucket has completed. Add bucketPolicyLoaded, reset before each GET and set only once the matching response lands, and check it at the top of the Save handler. Verified with a jsdom simulation: clicking Save immediately after opening the dialog, before a (deliberately never-resolving) GET settles, now sends no PUT; a normal load-then-save sequence still PUTs the loaded policy unchanged. * admin: address further code review findings on the policy editor 1. s3tables.js: loadS3TablesBucketPolicy/loadS3TablesTablePolicy only reset the JSON textarea when a new load starts; the structured editor kept showing the previously loaded resource's statements (Editor tab is the default active one) until the new fetch resolved. Call loadPolicyTextareaIntoEditor() against the now-cleared textarea immediately, so switching resources visibly resets the editor right away instead of only once its own load completes. Verified with jsdom: opening bucket A (loads fully) then bucket B (GET never resolves) no longer leaves A's statements visible in B's editor. 2. s3tables.js: deleteS3TablesBucketPolicy/deleteS3TablesTablePolicy had no loaded-state check, so a failed GET (which already blocks Save) left Delete fully able to remove the resource's stored policy sight unseen. Add the same s3tablesBucketPolicyLoaded/s3tablesTablePolicyLoaded guard Save already uses. Verified with jsdom: delete after a failed load now sends no DELETE; delete after a successful load is unaffected. 3. s3_buckets.templ: the bucket-policy Editor/JSON nav-tabs were missing the same ARIA roles already added to the S3 Tables policy tabs in an earlier round (role="tab"/"tabpanel", aria-selected, aria-controls, aria-labelledby) - this instance was out of scope for that review comment but is the same gap. Bootstrap's own tab.js already manages aria-selected on tab switch once the attribute exists, so no extra JS was needed. 4. s3_buckets.templ: neither the bucket-policy Save nor Delete handler guarded against a double-click, or against firing while the other was still in flight - two overlapping PUT/DELETE requests for the same bucket could land in either order. Add a shared bucketPolicyMutationInFlight flag: set (and both buttons disabled) before each fetch, cleared (and buttons re-enabled) on failure so the user can retry, left set through the existing success hide-and-reload path, and also reset when a new bucket's dialog opens so an abandoned in-flight request from a closed dialog can't leave the buttons stuck disabled. Verified with jsdom: double-clicking Save now sends exactly one PUT, and a Delete click while that PUT is still pending sends no DELETE. * admin: scope bucket-policy mutation completions to the bucket that started them 1. The previous round's fix reset bucketPolicyMutationInFlight whenever a new bucket's policy dialog opened, to avoid leaving Save/Delete stuck disabled if the modal was closed mid-request. That traded one bug for a worse one: if bucket A's PUT/DELETE was still in flight when the user opened bucket B's dialog, the reset let B's Save/Delete fire immediately, and A's completion handler - unaware anything had changed - would still hide the (now B's) modal and reload the page out from under whatever the user was doing with B, on success, or alert a message with no bucket context, on failure. Stop resetting on reopen, so a pending mutation for a previous bucket keeps this bucket's Save/Delete blocked until it settles (matches the "preventing overlapping mutations" the review comment describes). Instead, capture policyEditorBucket as targetBucket right before each fetch and compare it against policyEditorBucket again in the completion handler: the in-flight flag is always released so the buttons never get stuck, but the modal-hide/reload/alert only fire if this bucket is still the one showing; a stale completion for an abandoned bucket just logs to the console instead. Verified with a jsdom simulation: opening bucket B while bucket A's Save is still pending leaves B's Save button disabled and a click on it a no-op; once A's PUT resolves, B's button re-enables but no modal.hide()/reload() fires (previously both fired unconditionally). 2. bucketPolicyDeleteBtn had no bucketPolicyLoaded check, unlike Save - a failed GET blocked Save but left Delete free to remove a policy the client never actually saw (the same gap already fixed for the S3 Tables policy modals in an earlier round). Added the same guard, ahead of the confirm() dialog. Verified with jsdom: Delete after a failed load now sends no DELETE request. * admin: fix spelling mistake --- weed/admin/dash/admin_server.go | 19 + weed/admin/dash/bucket_management.go | 95 ++ weed/admin/dash/bucket_policy.go | 192 ++++ weed/admin/dash/bucket_policy_test.go | 168 ++++ weed/admin/dash/s3tables_management.go | 34 +- weed/admin/dash/types.go | 6 + weed/admin/handlers/admin_handlers.go | 3 + .../handlers/admin_handlers_routes_test.go | 20 + weed/admin/static/js/policy_editor.js | 886 ++++++++++++++++++ weed/admin/static/js/s3tables.js | 133 ++- weed/admin/static_gz/js/policy_editor.js.gz | Bin 0 -> 11086 bytes weed/admin/static_gz/js/s3tables.js.gz | Bin 5826 -> 6980 bytes weed/admin/view/app/policies.templ | 748 +-------------- weed/admin/view/app/policies_templ.go | 25 +- weed/admin/view/app/policy_datalists.templ | 28 + weed/admin/view/app/policy_datalists_templ.go | 71 ++ weed/admin/view/app/s3_buckets.templ | 317 ++++++- weed/admin/view/app/s3_buckets_templ.go | 335 ++++--- weed/admin/view/app/s3tables_buckets.templ | 42 +- weed/admin/view/app/s3tables_buckets_templ.go | 278 +++--- weed/admin/view/app/s3tables_tables.templ | 25 +- weed/admin/view/app/s3tables_tables_templ.go | 66 +- weed/admin/view/layout/layout.templ | 1 + weed/admin/view/layout/layout_templ.go | 239 ++--- weed/s3api/policy_engine/bucket_policy.go | 86 ++ .../s3api/policy_engine/bucket_policy_test.go | 106 +++ weed/s3api/s3api_bucket_policy_handlers.go | 80 +- 27 files changed, 2752 insertions(+), 1251 deletions(-) create mode 100644 weed/admin/dash/bucket_policy.go create mode 100644 weed/admin/dash/bucket_policy_test.go create mode 100644 weed/admin/static/js/policy_editor.js create mode 100644 weed/admin/static_gz/js/policy_editor.js.gz create mode 100644 weed/admin/view/app/policy_datalists.templ create mode 100644 weed/admin/view/app/policy_datalists_templ.go create mode 100644 weed/s3api/policy_engine/bucket_policy.go create mode 100644 weed/s3api/policy_engine/bucket_policy_test.go diff --git a/weed/admin/dash/admin_server.go b/weed/admin/dash/admin_server.go index c76815736..ba70b5e09 100644 --- a/weed/admin/dash/admin_server.go +++ b/weed/admin/dash/admin_server.go @@ -2,6 +2,7 @@ package dash import ( "context" + "encoding/json" "errors" "fmt" "io" @@ -34,6 +35,7 @@ import ( "github.com/seaweedfs/seaweedfs/weed/s3api" "github.com/seaweedfs/seaweedfs/weed/s3api/lifecycle_xml" + "github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine" "github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants" "github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle" "github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/scheduler" @@ -888,6 +890,7 @@ func (s *AdminServer) GetS3Buckets() ([]S3Bucket, error) { Owner: owner, LifecycleRuleCount: lifecycleRuleCount, LifecycleEnabledCount: lifecycleEnabledCount, + PolicyStatementCount: extractPolicyStatementCountFromEntry(resp.Entry), } buckets = append(buckets, bucket) } @@ -993,6 +996,7 @@ func (s *AdminServer) GetBucketDetails(bucketName string) (*BucketDetails, error details.Bucket.ObjectLockDuration = objectLockDuration details.Bucket.Owner = owner details.Bucket.LifecycleRuleCount, details.Bucket.LifecycleEnabledCount = extractLifecycleCountsFromEntry(bucketResp.Entry) + details.Bucket.PolicyStatementCount = extractPolicyStatementCountFromEntry(bucketResp.Entry) return nil }) @@ -2106,6 +2110,21 @@ func extractLifecycleCountsFromEntry(entry *filer_pb.Entry) (ruleCount, enabledC return } +// extractPolicyStatementCountFromEntry returns the number of statements in +// the bucket's policy, or 0 if it has none or the stored JSON can't be +// parsed. Forgiving on parse failure, same as extractLifecycleCountsFromEntry. +func extractPolicyStatementCountFromEntry(entry *filer_pb.Entry) int { + policyJSON := entry.Extended[s3api.BUCKET_POLICY_METADATA_KEY] + if len(policyJSON) == 0 { + return 0 + } + var doc policy_engine.PolicyDocument + if err := json.Unmarshal(policyJSON, &doc); err != nil { + return 0 + } + return len(doc.Statement) +} + // GetConfigPersistence returns the config persistence manager func (as *AdminServer) GetConfigPersistence() *ConfigPersistence { return as.configPersistence diff --git a/weed/admin/dash/bucket_management.go b/weed/admin/dash/bucket_management.go index 2e6072e52..07e649a50 100644 --- a/weed/admin/dash/bucket_management.go +++ b/weed/admin/dash/bucket_management.go @@ -13,6 +13,7 @@ import ( "github.com/seaweedfs/seaweedfs/weed/filer" "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb" "github.com/seaweedfs/seaweedfs/weed/s3api" + "github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine" "github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants" "github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle" ) @@ -257,6 +258,100 @@ func validateBucketLifecycleRules(rules []BucketLifecycleRule) error { return nil } +// ShowBucketPolicy returns the policy document for a specific bucket, or +// {"bucket": ..., "policy": null} if the bucket has none. +func (s *AdminServer) ShowBucketPolicy(w http.ResponseWriter, r *http.Request) { + bucketName := mux.Vars(r)["bucket"] + if bucketName == "" { + writeJSONError(w, http.StatusBadRequest, "Bucket name is required") + return + } + + policy, err := s.GetBucketPolicy(bucketName) + if err != nil { + writeJSONError(w, bucketPolicyErrorStatus(err), "Failed to get bucket policy: "+err.Error()) + return + } + + writeJSON(w, http.StatusOK, map[string]interface{}{ + "bucket": bucketName, + "policy": policy, + }) +} + +// UpdateBucketPolicy replaces the bucket policy for a bucket. +func (s *AdminServer) UpdateBucketPolicy(w http.ResponseWriter, r *http.Request) { + if !requireSessionCSRFToken(w, r) { + return + } + + bucketName := mux.Vars(r)["bucket"] + if bucketName == "" { + writeJSONError(w, http.StatusBadRequest, "Bucket name is required") + return + } + + var req struct { + Policy *policy_engine.PolicyDocument `json:"policy"` + } + if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil { + writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error()) + return + } + if req.Policy == nil { + writeJSONError(w, http.StatusBadRequest, "policy is required; use DELETE to clear a bucket policy") + return + } + + if err := s.SetBucketPolicy(bucketName, req.Policy); err != nil { + writeJSONError(w, bucketPolicyErrorStatus(err), "Failed to update bucket policy: "+err.Error()) + return + } + + writeJSON(w, http.StatusOK, map[string]interface{}{ + "message": "Bucket policy updated successfully", + "bucket": bucketName, + }) +} + +// RemoveBucketPolicy clears the bucket policy for a bucket. Named +// "Remove", not "Delete", because (*AdminServer).DeleteBucketPolicy is the +// data-layer method this handler calls. +func (s *AdminServer) RemoveBucketPolicy(w http.ResponseWriter, r *http.Request) { + if !requireSessionCSRFToken(w, r) { + return + } + + bucketName := mux.Vars(r)["bucket"] + if bucketName == "" { + writeJSONError(w, http.StatusBadRequest, "Bucket name is required") + return + } + + if err := s.DeleteBucketPolicy(bucketName); err != nil { + writeJSONError(w, bucketPolicyErrorStatus(err), "Failed to delete bucket policy: "+err.Error()) + return + } + + writeJSON(w, http.StatusOK, map[string]interface{}{ + "message": "Bucket policy deleted successfully", + "bucket": bucketName, + }) +} + +// bucketPolicyErrorStatus keeps a request for a bucket that does not exist, +// or an invalid policy document, out of the 5xx bucket where a client +// would retry it. Mirrors bucketLifecycleErrorStatus. +func bucketPolicyErrorStatus(err error) int { + if errors.Is(err, ErrBucketNotFound) { + return http.StatusNotFound + } + if errors.Is(err, ErrInvalidBucketPolicy) { + return http.StatusBadRequest + } + return http.StatusInternalServerError +} + // CreateBucket creates a new S3 bucket func (s *AdminServer) CreateBucket(w http.ResponseWriter, r *http.Request) { var req CreateBucketRequest diff --git a/weed/admin/dash/bucket_policy.go b/weed/admin/dash/bucket_policy.go new file mode 100644 index 000000000..0a860f919 --- /dev/null +++ b/weed/admin/dash/bucket_policy.go @@ -0,0 +1,192 @@ +package dash + +import ( + "context" + "encoding/json" + "errors" + "fmt" + + "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb" + "github.com/seaweedfs/seaweedfs/weed/s3api" + "github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine" + "github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants" +) + +// MaxBucketPolicySize mirrors AWS S3's 20 KB bucket-policy limit. This is an +// admin-side cap the S3 gateway does not itself enforce; it can only reject +// a policy the gateway would have accepted, never disagree about one +// already stored, so it cannot desync admin and S3 behavior. +const MaxBucketPolicySize = 20 * 1024 + +// ErrInvalidBucketPolicy wraps a validation failure from SetBucketPolicy so +// callers (the HTTP handler) can map it to 400 instead of 500 without +// resorting to matching on the error string. +var ErrInvalidBucketPolicy = errors.New("invalid bucket policy") + +// GetBucketPolicy returns the policy document stored on a bucket's filer +// entry, or (nil, nil) if the bucket has no policy — that is not an error, +// it just means the caller (e.g. the admin UI) should show an empty editor +// instead of special-casing a 404. +func (s *AdminServer) GetBucketPolicy(bucketName string) (*policy_engine.PolicyDocument, error) { + filerConfig, err := s.getFilerConfig() + if err != nil { + return nil, fmt.Errorf("get filer configuration: %w", err) + } + + var doc *policy_engine.PolicyDocument + err = s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error { + resp, err := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{ + Directory: filerConfig.BucketsPath, + Name: bucketName, + }) + if err != nil { + if errors.Is(err, filer_pb.ErrNotFound) { + return fmt.Errorf("%w: %s", ErrBucketNotFound, bucketName) + } + return fmt.Errorf("look up bucket %s: %w", bucketName, err) + } + + policyJSON := resp.Entry.Extended[s3api.BUCKET_POLICY_METADATA_KEY] + if len(policyJSON) == 0 { + return nil + } + + var parsed policy_engine.PolicyDocument + if err := json.Unmarshal(policyJSON, &parsed); err != nil { + return fmt.Errorf("parse stored bucket policy: %w", err) + } + doc = &parsed + return nil + }) + if err != nil { + return nil, err + } + + return doc, nil +} + +// SetBucketPolicy validates and stores a bucket policy, applying the exact +// same validation the S3 gateway's PutBucketPolicy enforces +// (policy_engine.ValidatePolicy + policy_engine.ValidateBucketPolicy), so +// the admin UI and the S3 API never disagree about what's a valid policy. +// +// Propagation to every S3 gateway is automatic: writing the +// s3-bucket-policy extended attribute drives the filer metadata log, which +// each gateway's onBucketMetadataChange subscription already watches to +// rebuild its bucket policy cache. No separate notify step is needed here. +// +// Note: PutBucketPolicyHandler on the S3 gateway also mirrors the policy +// into the IAM policy store under "bucket-policy:" +// (iam_manager.go's UpdateBucketPolicy), but its delete counterpart +// (removeBucketPolicyFromIAM) is an unimplemented TODO — so that mirror is +// already unreliable after any S3-side DeleteBucketPolicy. The admin write +// path deliberately does not replicate it: doing so would only deepen an +// existing inconsistency, and admin has no handle on the S3 gateway's +// iamManager anyway. See the TODO in +// weed/s3api/s3api_bucket_policy_handlers.go for the follow-up. +func (s *AdminServer) SetBucketPolicy(bucketName string, doc *policy_engine.PolicyDocument) error { + if err := policy_engine.ValidatePolicy(doc); err != nil { + return fmt.Errorf("%w: %w", ErrInvalidBucketPolicy, err) + } + if err := policy_engine.ValidateBucketPolicy(doc, bucketName); err != nil { + return fmt.Errorf("%w: %w", ErrInvalidBucketPolicy, err) + } + + policyJSON, err := json.Marshal(doc) + if err != nil { + return fmt.Errorf("marshal policy document: %w", err) + } + if len(policyJSON) > MaxBucketPolicySize { + return fmt.Errorf("%w: bucket policy is %d bytes, which exceeds the %d byte limit", ErrInvalidBucketPolicy, len(policyJSON), MaxBucketPolicySize) + } + + filerConfig, err := s.getFilerConfig() + if err != nil { + return fmt.Errorf("get filer configuration: %w", err) + } + + return s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error { + // PATCH_EXTENDED is a no-op on a missing entry, so the existence + // check has to happen here rather than fall out of the write. + if _, err := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{ + Directory: filerConfig.BucketsPath, + Name: bucketName, + }); err != nil { + if errors.Is(err, filer_pb.ErrNotFound) { + return fmt.Errorf("%w: %s", ErrBucketNotFound, bucketName) + } + return fmt.Errorf("look up bucket %s: %w", bucketName, err) + } + + bucketPath := filerConfig.BucketsPath + "/" + bucketName + resp, err := client.ObjectTransaction(context.Background(), &filer_pb.ObjectTransactionRequest{ + LockKey: bucketPath, + RouteKey: s3_constants.ObjectWriteRouteKeyPrefix + bucketPath, + Mutations: []*filer_pb.ObjectMutation{bucketPolicyMutation(filerConfig.BucketsPath, bucketName, policyJSON)}, + }) + if err != nil { + return fmt.Errorf("failed to update bucket policy: %w", err) + } + if resp.Error != "" { + return fmt.Errorf("failed to update bucket policy: %s", resp.Error) + } + return nil + }) +} + +// DeleteBucketPolicy clears the bucket policy stored on a bucket's filer +// entry. Deleting a policy that doesn't exist is a success, matching +// DeleteBucketLifecycle's idempotent behavior. +func (s *AdminServer) DeleteBucketPolicy(bucketName string) error { + filerConfig, err := s.getFilerConfig() + if err != nil { + return fmt.Errorf("get filer configuration: %w", err) + } + + return s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error { + if _, err := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{ + Directory: filerConfig.BucketsPath, + Name: bucketName, + }); err != nil { + if errors.Is(err, filer_pb.ErrNotFound) { + return fmt.Errorf("%w: %s", ErrBucketNotFound, bucketName) + } + return fmt.Errorf("look up bucket %s: %w", bucketName, err) + } + + bucketPath := filerConfig.BucketsPath + "/" + bucketName + resp, err := client.ObjectTransaction(context.Background(), &filer_pb.ObjectTransactionRequest{ + LockKey: bucketPath, + RouteKey: s3_constants.ObjectWriteRouteKeyPrefix + bucketPath, + Mutations: []*filer_pb.ObjectMutation{bucketPolicyMutation(filerConfig.BucketsPath, bucketName, nil)}, + }) + if err != nil { + return fmt.Errorf("failed to delete bucket policy: %w", err) + } + if resp.Error != "" { + return fmt.Errorf("failed to delete bucket policy: %s", resp.Error) + } + return nil + }) +} + +// bucketPolicyMutation patches only the policy key rather than writing the +// whole entry back: the filer re-reads and merges under the bucket path +// lock, so a concurrent owner/quota/versioning/lifecycle change is +// preserved instead of being reverted by a stale snapshot. Same pattern as +// bucketLifecycleMutation. A nil/empty policyJSON clears the key. +func bucketPolicyMutation(bucketsPath, bucketName string, policyJSON []byte) *filer_pb.ObjectMutation { + mutation := &filer_pb.ObjectMutation{ + Type: filer_pb.ObjectMutation_PATCH_EXTENDED, + Directory: bucketsPath, + Name: bucketName, + } + if len(policyJSON) > 0 { + mutation.SetExtended = map[string][]byte{ + s3api.BUCKET_POLICY_METADATA_KEY: policyJSON, + } + return mutation + } + mutation.DeleteExtended = []string{s3api.BUCKET_POLICY_METADATA_KEY} + return mutation +} diff --git a/weed/admin/dash/bucket_policy_test.go b/weed/admin/dash/bucket_policy_test.go new file mode 100644 index 000000000..df8c19ce3 --- /dev/null +++ b/weed/admin/dash/bucket_policy_test.go @@ -0,0 +1,168 @@ +package dash + +import ( + "encoding/json" + "errors" + "fmt" + "net/http" + "strings" + "testing" + + "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb" + "github.com/seaweedfs/seaweedfs/weed/s3api" + "github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine" +) + +func validBucketPolicyJSON(bucket string) []byte { + return []byte(fmt.Sprintf(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::%s/*"}]}`, bucket)) +} + +func validBucketPolicyDoc(bucket string) *policy_engine.PolicyDocument { + var doc policy_engine.PolicyDocument + if err := json.Unmarshal(validBucketPolicyJSON(bucket), &doc); err != nil { + panic(err) + } + return &doc +} + +func TestBucketPolicyMutation_SetsPolicy(t *testing.T) { + policyJSON := validBucketPolicyJSON("mybucket") + m := bucketPolicyMutation("/buckets", "mybucket", policyJSON) + + if m.Type != filer_pb.ObjectMutation_PATCH_EXTENDED { + t.Fatalf("expected a PATCH_EXTENDED mutation, got %v", m.Type) + } + if m.Directory != "/buckets" || m.Name != "mybucket" { + t.Fatalf("expected the mutation to target /buckets/mybucket, got %s/%s", m.Directory, m.Name) + } + if got := m.SetExtended[s3api.BUCKET_POLICY_METADATA_KEY]; string(got) != string(policyJSON) { + t.Fatalf("expected the policy key to carry the marshaled document, got %q", got) + } + if len(m.DeleteExtended) != 0 { + t.Fatalf("expected no key deletions when saving a policy, got %v", m.DeleteExtended) + } +} + +func TestBucketPolicyMutation_ClearsKey(t *testing.T) { + m := bucketPolicyMutation("/buckets", "mybucket", nil) + + if len(m.SetExtended) != 0 { + t.Fatalf("expected no key writes when clearing, got %v", m.SetExtended) + } + if len(m.DeleteExtended) != 1 || m.DeleteExtended[0] != s3api.BUCKET_POLICY_METADATA_KEY { + t.Fatalf("expected only the policy key to be cleared, got %v", m.DeleteExtended) + } +} + +// A whole-entry write would have carried the rest of the bucket entry with +// it; the patch must name only the key it owns, so a concurrent owner, +// quota, or lifecycle change survives. +func TestBucketPolicyMutation_TouchesOnlyPolicyKey(t *testing.T) { + for _, m := range []*filer_pb.ObjectMutation{ + bucketPolicyMutation("/buckets", "mybucket", validBucketPolicyJSON("mybucket")), + bucketPolicyMutation("/buckets", "mybucket", nil), + } { + if m.Entry != nil { + t.Fatal("expected the mutation to carry no entry snapshot") + } + if m.SetContent { + t.Fatal("expected the mutation to leave entry content alone") + } + for k := range m.SetExtended { + if k != s3api.BUCKET_POLICY_METADATA_KEY { + t.Fatalf("unexpected key written: %s", k) + } + } + for _, k := range m.DeleteExtended { + if k != s3api.BUCKET_POLICY_METADATA_KEY { + t.Fatalf("unexpected key deleted: %s", k) + } + } + } +} + +func TestExtractPolicyStatementCountFromEntry(t *testing.T) { + tests := []struct { + name string + entry *filer_pb.Entry + want int + }{ + {"no extended attrs", &filer_pb.Entry{}, 0}, + {"absent key", &filer_pb.Entry{Extended: map[string][]byte{"other": []byte("x")}}, 0}, + {"one statement", &filer_pb.Entry{Extended: map[string][]byte{ + s3api.BUCKET_POLICY_METADATA_KEY: validBucketPolicyJSON("b"), + }}, 1}, + {"three statements", &filer_pb.Entry{Extended: map[string][]byte{ + s3api.BUCKET_POLICY_METADATA_KEY: []byte(`{"Version":"2012-10-17","Statement":[ + {"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*"}, + {"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::b/*"}, + {"Effect":"Deny","Principal":"*","Action":"s3:DeleteObject","Resource":"arn:aws:s3:::b/*"} + ]}`), + }}, 3}, + {"garbage bytes", &filer_pb.Entry{Extended: map[string][]byte{ + s3api.BUCKET_POLICY_METADATA_KEY: []byte("not json"), + }}, 0}, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + if got := extractPolicyStatementCountFromEntry(tt.entry); got != tt.want { + t.Errorf("extractPolicyStatementCountFromEntry() = %d, want %d", got, tt.want) + } + }) + } +} + +func TestBucketPolicyErrorStatus(t *testing.T) { + if got := bucketPolicyErrorStatus(fmt.Errorf("%w: mybucket", ErrBucketNotFound)); got != http.StatusNotFound { + t.Fatalf("expected a missing bucket to map to 404, got %d", got) + } + if got := bucketPolicyErrorStatus(fmt.Errorf("%w: bad statement", ErrInvalidBucketPolicy)); got != http.StatusBadRequest { + t.Fatalf("expected an invalid policy to map to 400, got %d", got) + } + if got := bucketPolicyErrorStatus(errors.New("filer unreachable")); got != http.StatusInternalServerError { + t.Fatalf("expected an unrelated failure to stay 500, got %d", got) + } +} + +func TestSetBucketPolicy_RejectsOversized(t *testing.T) { + // A resource list long enough to blow the cap: this must fail before + // any filer call, which is what makes it testable without one. + doc := validBucketPolicyDoc("mybucket") + doc.Statement[0].Sid = strings.Repeat("x", MaxBucketPolicySize+1) + + err := (&AdminServer{}).SetBucketPolicy("mybucket", doc) + if err == nil { + t.Fatal("expected an oversized bucket policy to be rejected") + } + if !errors.Is(err, ErrInvalidBucketPolicy) { + t.Fatalf("expected an ErrInvalidBucketPolicy, got: %v", err) + } +} + +func TestSetBucketPolicy_RejectsForeignResource(t *testing.T) { + // Proves the shared policy_engine.ValidateBucketPolicy validator is + // actually wired in: this is exactly the check the S3 gateway applies. + doc := validBucketPolicyDoc("mybucket") + doc.Statement[0].Resource = policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::other-bucket/*") + + err := (&AdminServer{}).SetBucketPolicy("mybucket", doc) + if err == nil { + t.Fatal("expected a policy referencing a different bucket to be rejected") + } + if !errors.Is(err, ErrInvalidBucketPolicy) { + t.Fatalf("expected an ErrInvalidBucketPolicy, got: %v", err) + } +} + +func TestSetBucketPolicy_RejectsMissingPrincipal(t *testing.T) { + doc := validBucketPolicyDoc("mybucket") + doc.Statement[0].Principal = nil + + err := (&AdminServer{}).SetBucketPolicy("mybucket", doc) + if err == nil { + t.Fatal("expected a policy with no Principal to be rejected") + } + if !errors.Is(err, ErrInvalidBucketPolicy) { + t.Fatalf("expected an ErrInvalidBucketPolicy, got: %v", err) + } +} diff --git a/weed/admin/dash/s3tables_management.go b/weed/admin/dash/s3tables_management.go index d1f1c641b..78c35bb03 100644 --- a/weed/admin/dash/s3tables_management.go +++ b/weed/admin/dash/s3tables_management.go @@ -37,6 +37,12 @@ type S3TablesBucketSummary struct { // Format is empty for a bucket created before formats were declared. Such a // bucket takes tables of either format, which is what it always did. Format string `json:"format,omitempty"` + // PolicyStatementCount is the number of statements in the table bucket's + // resource policy, or 0 if it has none. Unrelated to the S3 bucket + // policy mechanism (policy_engine.PolicyDocument / s3-bucket-policy): + // S3 Tables stores its own s3tables.PolicyDocument under the + // s3tables.policy extended attribute. + PolicyStatementCount int `json:"policy_statement_count"` } type S3TablesNamespacesData struct { @@ -144,11 +150,12 @@ func (s *AdminServer) GetS3TablesBucketsData(ctx context.Context) (S3TablesBucke continue } buckets = append(buckets, S3TablesBucketSummary{ - ARN: arn, - Name: entry.Entry.Name, - OwnerAccountID: metadata.OwnerAccountID, - CreatedAt: metadata.CreatedAt, - Format: metadata.Format, + ARN: arn, + Name: entry.Entry.Name, + OwnerAccountID: metadata.OwnerAccountID, + CreatedAt: metadata.CreatedAt, + Format: metadata.Format, + PolicyStatementCount: extractS3TablesPolicyStatementCountFromEntry(entry.Entry), }) } return nil @@ -165,6 +172,23 @@ func (s *AdminServer) GetS3TablesBucketsData(ctx context.Context) (S3TablesBucke }, nil } +// extractS3TablesPolicyStatementCountFromEntry returns the number of +// statements in the table bucket's resource policy, or 0 if it has none or +// the stored JSON can't be parsed. Forgiving on parse failure, matching +// extractPolicyStatementCountFromEntry (the S3 bucket policy equivalent in +// admin_server.go, which is a different, unrelated policy mechanism). +func extractS3TablesPolicyStatementCountFromEntry(entry *filer_pb.Entry) int { + policyJSON := entry.Extended[s3tables.ExtendedKeyPolicy] + if len(policyJSON) == 0 { + return 0 + } + var doc s3tables.PolicyDocument + if err := json.Unmarshal(policyJSON, &doc); err != nil { + return 0 + } + return len(doc.Statement) +} + // observedRowCounts collects what workers last reported for these tables. For a // format admin cannot read, this is the only row count that exists. func (s *AdminServer) observedRowCounts(bucketArn string, namespaceParts []string, tables []s3tables.TableSummary) map[string]string { diff --git a/weed/admin/dash/types.go b/weed/admin/dash/types.go index a161f8bf7..b30da7961 100644 --- a/weed/admin/dash/types.go +++ b/weed/admin/dash/types.go @@ -98,6 +98,12 @@ type S3Bucket struct { LifecycleRuleCount int `json:"lifecycle_rule_count"` LifecycleEnabledCount int `json:"lifecycle_enabled_count"` + + // PolicyStatementCount is the number of statements in the bucket policy, + // or 0 if the bucket has none. A policy document can't have zero + // statements (see policy_engine.ValidatePolicy), so >0 is a faithful + // "has a policy" flag. + PolicyStatementCount int `json:"policy_statement_count"` } type S3Object struct { diff --git a/weed/admin/handlers/admin_handlers.go b/weed/admin/handlers/admin_handlers.go index 767790764..67131b4b7 100644 --- a/weed/admin/handlers/admin_handlers.go +++ b/weed/admin/handlers/admin_handlers.go @@ -183,6 +183,9 @@ func (h *AdminHandlers) registerAPIRoutes(api *mux.Router, enforceWrite bool) { s3Api.Handle("/buckets/{bucket}/lifecycle", wrapWrite(h.adminServer.DeleteBucketLifecycle)).Methods(http.MethodDelete) s3Api.Handle("/buckets/{bucket}/quota", wrapWrite(h.adminServer.UpdateBucketQuota)).Methods(http.MethodPut) s3Api.Handle("/buckets/{bucket}/owner", wrapWrite(h.adminServer.UpdateBucketOwner)).Methods(http.MethodPut) + s3Api.HandleFunc("/buckets/{bucket}/policy", h.adminServer.ShowBucketPolicy).Methods(http.MethodGet) + s3Api.Handle("/buckets/{bucket}/policy", wrapWrite(h.adminServer.UpdateBucketPolicy)).Methods(http.MethodPut) + s3Api.Handle("/buckets/{bucket}/policy", wrapWrite(h.adminServer.RemoveBucketPolicy)).Methods(http.MethodDelete) usersApi := api.PathPrefix("/users").Subrouter() usersApi.HandleFunc("", h.userHandlers.GetUsers).Methods(http.MethodGet) diff --git a/weed/admin/handlers/admin_handlers_routes_test.go b/weed/admin/handlers/admin_handlers_routes_test.go index 9cbd35528..1cc0728ca 100644 --- a/weed/admin/handlers/admin_handlers_routes_test.go +++ b/weed/admin/handlers/admin_handlers_routes_test.go @@ -62,6 +62,26 @@ func TestSetupRoutes_RegistersBucketLifecycleAPI_WithAuth(t *testing.T) { assertHasRoute(t, router, http.MethodDelete, "/api/s3/buckets/example/lifecycle") } +func TestSetupRoutes_RegistersBucketPolicyAPI_NoAuth(t *testing.T) { + router := mux.NewRouter() + + newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true) + + assertHasRoute(t, router, http.MethodGet, "/api/s3/buckets/example/policy") + assertHasRoute(t, router, http.MethodPut, "/api/s3/buckets/example/policy") + assertHasRoute(t, router, http.MethodDelete, "/api/s3/buckets/example/policy") +} + +func TestSetupRoutes_RegistersBucketPolicyAPI_WithAuth(t *testing.T) { + router := mux.NewRouter() + + newRouteTestAdminHandlers().SetupRoutes(router, true, "admin", "password", "", "", true) + + assertHasRoute(t, router, http.MethodGet, "/api/s3/buckets/example/policy") + assertHasRoute(t, router, http.MethodPut, "/api/s3/buckets/example/policy") + assertHasRoute(t, router, http.MethodDelete, "/api/s3/buckets/example/policy") +} + func TestSetupRoutes_RegistersPolicyAPI_NoAuth(t *testing.T) { router := mux.NewRouter() diff --git a/weed/admin/static/js/policy_editor.js b/weed/admin/static/js/policy_editor.js new file mode 100644 index 000000000..0f914ed77 --- /dev/null +++ b/weed/admin/static/js/policy_editor.js @@ -0,0 +1,886 @@ +// Shared visual policy editor: renders and edits an IAM/bucket policy +// document (Version + Statement list) via a structured form alongside a +// raw-JSON tab, kept in sync in both directions. +// +// Extracted from weed/admin/view/app/policies.templ (the IAM policy +// management page), which was its original and, for a while, only +// consumer. Any page embedding this editor must first render the shared +// datalists (see the PolicyDatalists templ component in +// weed/admin/view/app/policy_datalists.templ) and load this script after +// admin.js (for basePath/escapeHtml) and modal-alerts.js (for showAlert). +// +// Usage: call registerPolicyEditor(which, config) once to declare an +// editor instance (see its doc comment for the id conventions and +// config knobs), then setupPolicyEditor(which) once to wire up its DOM +// listeners. which is an arbitrary string ("create", "edit", +// "bucketPolicy", ...) that namespaces one editor instance's DOM ids and +// state from another's on the same page. + +// Per-`which` editor configuration. See registerPolicyEditor. +const POLICY_EDITOR_CONFIG = {}; + +// registerPolicyEditor declares (or redeclares) the configuration for one +// editor instance. Call before setupPolicyEditor(which), and again any +// time a config value (e.g. `bucket`) needs to change for an +// already-set-up instance (setupPolicyEditor only needs to run once per +// `which`; its DOM listeners read POLICY_EDITOR_CONFIG live). +// +// config: +// textareaId - id of the JSON ' + + '' + + '' + + ''; + }); + container.innerHTML = html; + } + + function policyListRowHtml(which, stmtIdx, field, itemIdx, value) { + const cfg = policyEditorConfig(which); + let listAttr = ''; + if (field === 'action') listAttr = ' list="' + cfg.actionDatalistId + '"'; + else if (field === 'resource') listAttr = ' list="' + cfg.resourceDatalistId + '"'; + else if (field === 'principal') listAttr = ' list="' + cfg.principalDatalistId + '"'; + return '
' + + '' + + '' + + '
'; + } + + // Reads whatever is currently displayed in the editor tab's DOM back into + // policyEditors[which], so nothing typed is lost before a save/tab-switch/serialize. + function commitPolicyEditorForm(which) { + const state = policyEditors[which]; + if (!state) return; + + document.querySelectorAll('.policy-stmt-sid[data-which="' + which + '"]').forEach(function(el) { + const idx = parseInt(el.getAttribute('data-index'), 10); + if (state.statements[idx]) state.statements[idx].sid = el.value; + }); + document.querySelectorAll('.policy-stmt-effect[data-which="' + which + '"]:checked').forEach(function(el) { + const idx = parseInt(el.getAttribute('data-index'), 10); + if (state.statements[idx]) state.statements[idx].effect = el.value; + }); + document.querySelectorAll('.policy-stmt-extras[data-which="' + which + '"]').forEach(function(el) { + const idx = parseInt(el.getAttribute('data-index'), 10); + if (state.statements[idx]) state.statements[idx].extras = el.value; + }); + document.querySelectorAll('.policy-stmt-resource-mode[data-which="' + which + '"]').forEach(function(el) { + const idx = parseInt(el.getAttribute('data-index'), 10); + if (state.statements[idx]) state.statements[idx].resourceMode = el.value; + }); + document.querySelectorAll('.policy-stmt-principal-mode[data-which="' + which + '"]').forEach(function(el) { + const idx = parseInt(el.getAttribute('data-index'), 10); + if (state.statements[idx]) state.statements[idx].principalMode = el.value; + }); + document.querySelectorAll('.policy-list-item[data-which="' + which + '"]').forEach(function(el) { + const idx = parseInt(el.getAttribute('data-index'), 10); + const itemIdx = parseInt(el.getAttribute('data-item-index'), 10); + const field = POLICY_LIST_FIELD_TO_STATE_KEY[el.getAttribute('data-field')] || 'resources'; + if (state.statements[idx] && state.statements[idx][field]) { + state.statements[idx][field][itemIdx] = el.value; + } + }); + } + + // Serializes policyEditors[which] into the JSON textarea. Call before + // switching to the JSON tab or before submitting, so the textarea always + // reflects the editor's current contents. + function commitPolicyEditorToTextarea(which) { + commitPolicyEditorForm(which); + const doc = policyEditorStateToDoc(policyEditors[which]); + document.getElementById(policyTextareaId(which)).value = JSON.stringify(doc, null, 2); + } + + // Parses the JSON textarea into policyEditors[which] and re-renders the + // editor. Returns false (and shows an alert) if the JSON is invalid or a + // statement's Effect isn't exactly "Allow"/"Deny", leaving the JSON tab + // as the active one so the user can fix it. + function commitPolicyTextareaToEditor(which) { + const text = document.getElementById(policyTextareaId(which)).value; + if (!text || !text.trim()) { + policyEditors[which] = { version: '2012-10-17', statements: [], otherFields: {} }; + renderPolicyEditor(which); + return true; + } + let doc; + try { + doc = JSON.parse(text); + } catch (e) { + showAlert('Invalid JSON in policy document: ' + e.message, 'error'); + return false; + } + let newState; + try { + newState = policyDocToEditorState(doc); + } catch (e) { + showAlert(e.message, 'error'); + return false; + } + policyEditors[which] = newState; + renderPolicyEditor(which); + return true; + } + + function activatePolicyTab(idKey, which) { + const btn = document.getElementById(policyEditorConfig(which)[idKey]); + if (btn) bootstrap.Tab.getOrCreateInstance(btn).show(); + } + + // Populates the editor for `which` from whatever is currently in its + // JSON textarea (typically right after a GET fills the textarea) and + // switches to whichever tab can actually show the result. + // + // Unlike commitPolicyTextareaToEditor - which assumes a tab is already + // showing and leaves it in place on failure so a Save can't silently + // clobber it - this function has no "current tab" to defer to: it is + // the thing that establishes one. So on a document the structured + // editor can't represent (invalid JSON, or valid JSON + // policyDocToEditorState rejects), it marks the state `unparsed` and + // switches to the JSON tab instead of leaving the Editor tab showing + // empty/stale state that a careless Save would serialize over the + // real document. Mirrors editPolicy's fallback in policies.templ. + function loadPolicyTextareaIntoEditor(which) { + const text = document.getElementById(policyTextareaId(which)).value; + if (!text || !text.trim()) { + policyEditors[which] = { version: '2012-10-17', statements: [], otherFields: {} }; + renderPolicyEditor(which); + activatePolicyTab('editorTabBtnId', which); + return true; + } + let doc; + try { + doc = JSON.parse(text); + } catch (e) { + policyEditors[which] = { version: '2012-10-17', statements: [], otherFields: {}, unparsed: true }; + renderPolicyEditor(which); + showAlert('Invalid JSON in stored policy: ' + e.message + '. ' + POLICY_JSON_TAB_ONLY_MESSAGE, 'error'); + activatePolicyTab('jsonTabBtnId', which); + return false; + } + let state; + try { + state = policyDocToEditorState(doc); + } catch (e) { + policyEditors[which] = { version: '2012-10-17', statements: [], otherFields: {}, unparsed: true }; + renderPolicyEditor(which); + showAlert(e.message + '. ' + POLICY_JSON_TAB_ONLY_MESSAGE, 'error'); + activatePolicyTab('jsonTabBtnId', which); + return false; + } + policyEditors[which] = state; + renderPolicyEditor(which); + activatePolicyTab('editorTabBtnId', which); + return true; + } + + function addPolicyStatement(which) { + if (policyEditorState(which).unparsed) { + showAlert(POLICY_JSON_TAB_ONLY_MESSAGE, 'error'); + return; + } + const cfg = policyEditorConfig(which); + commitPolicyEditorForm(which); + policyEditorState(which).statements.push({ + sid: '', effect: 'Allow', actions: [], + resourceMode: 'Resource', resources: cfg.bucket ? ['arn:aws:s3:::' + cfg.bucket + '/*'] : [], + principalMode: 'Principal', principalValues: cfg.requirePrincipal ? ['*'] : [], hasComplexPrincipal: false, + extras: '' + }); + renderPolicyEditor(which); + } + + // True while the JSON tab (rather than the Editor tab) is the one + // currently shown for `which`. + function isPolicyJsonTabActive(which) { + const jsonTabBtn = document.getElementById(policyEditorConfig(which).jsonTabBtnId); + return !!(jsonTabBtn && jsonTabBtn.classList.contains('active')); + } + + // Commits whichever tab is currently visible into the other side, so a + // save/validate action always uses what the user is actually looking at + // instead of silently overwriting it with stale state from the tab + // they're not on. Returns false (after alerting the user) if that isn't + // possible - e.g. invalid JSON on either side - so the caller can abort. + function commitPolicyActiveTab(which) { + if (isPolicyJsonTabActive(which)) { + // The JSON tab is the source of truth right now; parse it back + // into the structured editor to keep both in sync, but leave the + // textarea's own text untouched. + return commitPolicyTextareaToEditor(which); + } + if (policyEditorState(which).unparsed) { + // The editor never held this document, so serializing it would + // write an empty policy over whatever is in the JSON tab. + showAlert(POLICY_JSON_TAB_ONLY_MESSAGE, 'error'); + return false; + } + try { + commitPolicyEditorToTextarea(which); + return true; + } catch (e) { + showAlert(e.message, 'error'); + return false; + } + } + + // The admin API's policy document carries only Version and Statement, so + // any other top-level key (e.g. Id) is discarded server-side on save even + // though the editor round-trips it between tabs. Warn before that happens + // rather than letting the field vanish silently. Returns false if the + // user cancels. + function confirmPolicyFieldDiscard(which) { + const otherFields = Object.keys((policyEditors[which] || {}).otherFields || {}); + if (otherFields.length === 0) return true; + return confirm( + 'The following top-level field(s) are not supported and will be dropped when this policy is saved: ' + + otherFields.join(', ') + '.\n\nSave anyway?'); + } + + // Client-side check for the requirePrincipal config knob: returns an + // error message naming the first statement missing a Principal / + // NotPrincipal, or null if the document is fine. Purely a fast-feedback + // convenience - the server (policy_engine.ValidateBucketPolicy) is the + // actual authority on this rule and re-checks it regardless. + function validatePolicyEditorDoc(which, doc) { + if (!policyEditorConfig(which).requirePrincipal) return null; + const statements = (doc && doc.Statement) || []; + for (let i = 0; i < statements.length; i++) { + const stmt = statements[i] || {}; + if (stmt.Principal === undefined && stmt.NotPrincipal === undefined) { + return 'Statement ' + (i + 1) + ': a Principal (or NotPrincipal) is required.'; + } + } + return null; + } + + function setupPolicyEditor(which) { + const cfg = policyEditorConfig(which); + document.getElementById(cfg.addStatementBtnId).addEventListener('click', function() { + addPolicyStatement(which); + }); + + const editorTabBtn = document.getElementById(cfg.editorTabBtnId); + const jsonTabBtn = document.getElementById(cfg.jsonTabBtnId); + + jsonTabBtn.addEventListener('show.bs.tab', function(event) { + if (policyEditorState(which).unparsed) { + // The editor never held this document; serializing its empty + // placeholder state would overwrite the textarea we are about + // to show, which is the only copy of it. + return; + } + try { + commitPolicyEditorToTextarea(which); + } catch (e) { + showAlert(e.message, 'error'); + event.preventDefault(); + } + }); + editorTabBtn.addEventListener('show.bs.tab', function(event) { + if (!commitPolicyTextareaToEditor(which)) { + event.preventDefault(); + } + }); + + const body = document.getElementById(policyEditorBodyId(which)); + body.addEventListener('change', function(event) { + if (event.target.classList.contains('policy-stmt-resource-mode')) { + // Redraw so the NotResource hint follows the selected mode. + commitPolicyEditorForm(which); + renderPolicyEditor(which); + } + }); + body.addEventListener('click', function(event) { + const removeStmtBtn = event.target.closest('.policy-remove-statement-btn'); + if (removeStmtBtn) { + commitPolicyEditorForm(which); + const idx = parseInt(removeStmtBtn.getAttribute('data-index'), 10); + policyEditors[which].statements.splice(idx, 1); + renderPolicyEditor(which); + return; + } + const addItemBtn = event.target.closest('.policy-add-list-item-btn'); + if (addItemBtn) { + commitPolicyEditorForm(which); + const idx = parseInt(addItemBtn.getAttribute('data-index'), 10); + const field = POLICY_LIST_FIELD_TO_STATE_KEY[addItemBtn.getAttribute('data-field')] || 'resources'; + policyEditors[which].statements[idx][field].push(''); + renderPolicyEditor(which); + return; + } + const removeItemBtn = event.target.closest('.policy-remove-list-item-btn'); + if (removeItemBtn) { + commitPolicyEditorForm(which); + const idx = parseInt(removeItemBtn.getAttribute('data-index'), 10); + const itemIdx = parseInt(removeItemBtn.getAttribute('data-item-index'), 10); + const field = POLICY_LIST_FIELD_TO_STATE_KEY[removeItemBtn.getAttribute('data-field')] || 'resources'; + policyEditors[which].statements[idx][field].splice(itemIdx, 1); + renderPolicyEditor(which); + } + }); + + // Populate the shared Resource datalist as the user types/focuses a + // Resource field. Bootstrap's datalist filtering then narrows down + // whatever set of options was last loaded for the current path stage. + body.addEventListener('input', function(event) { + const target = event.target; + if (target.classList.contains('policy-list-item') && target.getAttribute('data-field') === 'resource') { + updatePolicyResourceSuggestions(which, target); + } + }); + body.addEventListener('focusin', function(event) { + const target = event.target; + if (target.classList.contains('policy-list-item') && target.getAttribute('data-field') === 'resource') { + updatePolicyResourceSuggestions(which, target); + } + }); + + // Same idea for the shared Principal datalist: a flat, one-time + // fetch (see loadPolicyPrincipalSuggestions), no per-segment logic + // needed since users/roles aren't hierarchical like bucket paths. + body.addEventListener('input', function(event) { + const target = event.target; + if (target.classList.contains('policy-list-item') && target.getAttribute('data-field') === 'principal') { + updatePolicyPrincipalSuggestions(which); + } + }); + body.addEventListener('focusin', function(event) { + const target = event.target; + if (target.classList.contains('policy-list-item') && target.getAttribute('data-field') === 'principal') { + updatePolicyPrincipalSuggestions(which); + } + }); + } + + // ------------------------------------------------------------------ + // Progressive Resource ARN autocomplete: suggests bucket names first + // (arn:aws:s3:::bucket), then once a bucket + "/" is typed, suggests + // arn:aws:s3:::bucket/* plus the direct subfolders one path segment at a + // time (fetched from the server on demand, one directory level per + // request, and cached per directory for the life of the page). + // ------------------------------------------------------------------ + + const POLICY_RESOURCE_ARN_PREFIX = 'arn:aws:s3:::'; + let policyBucketArnsPromise = null; + const policyFolderListCache = new Map(); + + function loadPolicyBucketArns() { + if (!policyBucketArnsPromise) { + policyBucketArnsPromise = fetch(basePath('/api/s3/buckets')) + .then(function(r) { return r.ok ? r.json() : { buckets: [] }; }) + .then(function(data) { + // Offer both the bucket itself and "every object in it", + // since the latter is what most Resource entries actually need. + return (data.buckets || []).reduce(function(acc, b) { + const arn = POLICY_RESOURCE_ARN_PREFIX + b.name; + acc.push(arn, arn + '/*'); + return acc; + }, []); + }) + .catch(function() { return []; }); + } + return policyBucketArnsPromise; + } + + function loadPolicyFolderNames(dirPath, prefix) { + // Send the segment still being typed as a prefix so the filer does the + // filtering: without it the server pages through every entry in the + // directory, which on a bucket of flat object keys is the whole bucket. + const key = dirPath + '\n' + prefix; + if (!policyFolderListCache.has(key)) { + policyFolderListCache.set(key, fetch(basePath('/api/files/list-folders?path=' + encodeURIComponent(dirPath) + + '&prefix=' + encodeURIComponent(prefix))) + .then(function(r) { + if (!r.ok) throw new Error('list-folders request failed with status ' + r.status); + return r.json(); + }) + .then(function(data) { return data.folders || []; }) + .catch(function() { + // Don't let a transient failure permanently poison the + // cache for this directory; let the next call retry. + policyFolderListCache.delete(key); + return []; + })); + } + return policyFolderListCache.get(key); + } + + // Figures out what stage of the ARN the user is currently typing: + // still the bucket name ("bucket"), or a folder path segment after the + // bucket ("folder", with dirPath being the filer directory to list and + // arnPrefix being the ARN text to append suggestions onto). + function policyResourcePathState(value) { + value = value || ''; + if (value.indexOf(POLICY_RESOURCE_ARN_PREFIX) !== 0) { + return { stage: 'bucket' }; + } + const rest = value.slice(POLICY_RESOURCE_ARN_PREFIX.length); + const segments = rest.split('/'); + if (segments.length === 1) { + return { stage: 'bucket' }; + } + const bucket = segments[0]; + const pathSegments = segments.slice(1, segments.length - 1); + const suffix = pathSegments.length ? '/' + pathSegments.join('/') : ''; + return { + stage: 'folder', + dirPath: '/buckets/' + bucket + suffix, + // The trailing, still-incomplete segment. The datalist narrows on + // it too, but sending it keeps the server's listing bounded. + prefix: segments[segments.length - 1], + arnPrefix: POLICY_RESOURCE_ARN_PREFIX + bucket + suffix + }; + } + + function renderPolicyDatalistOptions(datalist, values) { + datalist.innerHTML = values.map(function(v) { + return ''; + }).join(''); + } + + function updatePolicyResourceSuggestions(which, inputEl) { + const cfg = policyEditorConfig(which); + const datalist = document.getElementById(cfg.resourceDatalistId); + if (!datalist) return; + const state = policyResourcePathState(inputEl.value); + + if (state.stage === 'bucket') { + if (cfg.bucket) { + // Pinned to one bucket: no need to fetch and offer every + // bucket in the cluster, and the user can't be offered an + // ARN the server would reject anyway (see + // policy_engine.ValidateBucketPolicy). + renderPolicyDatalistOptions(datalist, [ + POLICY_RESOURCE_ARN_PREFIX + cfg.bucket, + POLICY_RESOURCE_ARN_PREFIX + cfg.bucket + '/*' + ]); + return; + } + loadPolicyBucketArns().then(function(arns) { + renderPolicyDatalistOptions(datalist, arns); + }); + return; + } + + loadPolicyFolderNames(state.dirPath, state.prefix).then(function(folders) { + const options = [state.arnPrefix + '/*']; + folders.forEach(function(name) { + options.push(state.arnPrefix + '/' + name); + }); + renderPolicyDatalistOptions(datalist, options); + }); + } + + // ------------------------------------------------------------------ + // Principal autocomplete: a flat list of existing users and IAM roles, + // fetched once from /api/principals and cached for the life of the page + // (unlike Resource ARNs, users/roles have no hierarchy to drill into). + // ------------------------------------------------------------------ + + let policyPrincipalSuggestionsPromise = null; + + function loadPolicyPrincipalSuggestions() { + if (!policyPrincipalSuggestionsPromise) { + policyPrincipalSuggestionsPromise = fetch(basePath('/api/principals')) + .then(function(r) { return r.ok ? r.json() : { principals: [] }; }) + .then(function(data) { return ['*'].concat(data.principals || []); }) + .catch(function() { return ['*']; }); + } + return policyPrincipalSuggestionsPromise; + } + + function updatePolicyPrincipalSuggestions(which) { + const datalist = document.getElementById(policyEditorConfig(which).principalDatalistId); + if (!datalist) return; + loadPolicyPrincipalSuggestions().then(function(principals) { + renderPolicyDatalistOptions(datalist, principals); + }); + } + + // Fills the structured editor (and the JSON tab) with a sample policy, + // regardless of which tab is currently active. + const POLICY_SAMPLE_DOCUMENT = { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "s3:GetObject", + "s3:PutObject" + ], + "Resource": [ + "arn:aws:s3:::my-bucket/*" + ] + } + ] + }; + + function insertSamplePolicy(which, sampleDoc) { + const doc = sampleDoc || POLICY_SAMPLE_DOCUMENT; + policyEditors[which] = policyDocToEditorState(doc); + renderPolicyEditor(which); + document.getElementById(policyTextareaId(which)).value = JSON.stringify(doc, null, 2); + } diff --git a/weed/admin/static/js/s3tables.js b/weed/admin/static/js/s3tables.js index 2ea7d9709..f143a71da 100644 --- a/weed/admin/static/js/s3tables.js +++ b/weed/admin/static/js/s3tables.js @@ -15,6 +15,23 @@ let s3tablesTablePolicyModal = null; let s3tablesTagsModal = null; let icebergTableDeleteModal = null; +// True only once a bucket/table policy GET has actually completed +// successfully (a genuinely empty policy counts). Guards the Save handlers +// below: a failed GET must not let a Save serialize the editor's cleared-out +// placeholder state as a real "Statement: []" document and overwrite +// whatever is actually stored. +let s3tablesBucketPolicyLoaded = false; +let s3tablesTablePolicyLoaded = false; + +// Bumped on every bucket/table policy load; a response only gets applied if +// its captured sequence number still matches. Without this, opening one +// resource's policy dialog and then another's before the first GET resolves +// lets the late response overwrite the second resource's textarea/editor +// state and mark it loaded, so a subsequent Save would push the first +// resource's policy onto the second resource. +let s3tablesBucketPolicyRequestSeq = 0; +let s3tablesTablePolicyRequestSeq = 0; + function getCSRFToken() { const tokenMeta = document.querySelector('meta[name="csrf-token"]'); if (!tokenMeta) { @@ -40,6 +57,15 @@ function initS3TablesBuckets() { s3tablesBucketPolicyModal = new bootstrap.Modal(document.getElementById('s3tablesBucketPolicyModal')); s3tablesTagsModal = new bootstrap.Modal(document.getElementById('s3tablesTagsModal')); + // Shared visual policy editor (weed/admin/static/js/policy_editor.js), + // reused here from the bucket policy admin page. Table bucket policies + // aren't validated against policy_engine.PolicyDocument server-side + // (see s3tables/permissions.go's separate PolicyDocument type), so no + // requirePrincipal/bucket config is set - the editor just gives a + // structured view over the same JSON the JSON tab holds. + registerPolicyEditor('s3tablesBucket', { textareaId: 's3tablesBucketPolicyText' }); + setupPolicyEditor('s3tablesBucket'); + const ownerSelect = document.getElementById('s3tablesBucketOwner'); if (ownerSelect) { document.getElementById('createS3TablesBucketModal').addEventListener('show.bs.modal', async function () { @@ -179,6 +205,11 @@ function initS3TablesBuckets() { if (policyForm) { policyForm.addEventListener('submit', async function (e) { e.preventDefault(); + if (!s3tablesBucketPolicyLoaded) { + alert('The current policy has not finished loading. Close and reopen this dialog before saving.'); + return; + } + if (!commitPolicyActiveTab('s3tablesBucket')) return; const bucketArn = document.getElementById('s3tablesBucketPolicyArn').value; const policy = document.getElementById('s3tablesBucketPolicyText').value.trim(); if (!policy) { @@ -227,6 +258,9 @@ function initS3TablesTables() { s3tablesTablePolicyModal = new bootstrap.Modal(document.getElementById('s3tablesTablePolicyModal')); s3tablesTagsModal = new bootstrap.Modal(document.getElementById('s3tablesTagsModal')); + registerPolicyEditor('s3tablesTable', { textareaId: 's3tablesTablePolicyText' }); + setupPolicyEditor('s3tablesTable'); + const dataContainer = document.getElementById('s3tables-tables-content'); const dataBucketArn = dataContainer.dataset.bucketArn || ''; const dataNamespace = dataContainer.dataset.namespace || ''; @@ -314,6 +348,11 @@ function initS3TablesTables() { if (policyForm) { policyForm.addEventListener('submit', async function (e) { e.preventDefault(); + if (!s3tablesTablePolicyLoaded) { + alert('The current policy has not finished loading. Close and reopen this dialog before saving.'); + return; + } + if (!commitPolicyActiveTab('s3tablesTable')) return; const policy = document.getElementById('s3tablesTablePolicyText').value.trim(); if (!policy) { alert('Policy JSON is required'); @@ -581,22 +620,51 @@ async function deleteS3TablesBucket() { } async function loadS3TablesBucketPolicy(bucketArn) { + const requestSeq = ++s3tablesBucketPolicyRequestSeq; document.getElementById('s3tablesBucketPolicyText').value = ''; - if (!bucketArn) return; - try { - const response = await fetch(s3tBasePath(`/api/s3tables/bucket-policy?bucket=${encodeURIComponent(bucketArn)}`)); - const data = await response.json(); - if (response.ok && data.policy) { - document.getElementById('s3tablesBucketPolicyText').value = data.policy; + s3tablesBucketPolicyLoaded = false; + // Reset the structured editor immediately too, so a still-open Editor + // tab doesn't keep showing the previously loaded resource's statements + // while this fetch is in flight. + loadPolicyTextareaIntoEditor('s3tablesBucket'); + if (bucketArn) { + let policyText = ''; + let loadError = null; + try { + const response = await fetch(s3tBasePath(`/api/s3tables/bucket-policy?bucket=${encodeURIComponent(bucketArn)}`)); + const data = await response.json(); + if (!response.ok) { + throw new Error(data.error || ('HTTP ' + response.status)); + } + if (data.policy) { + policyText = data.policy; + } + } catch (error) { + loadError = error; } - } catch (error) { - console.error('Failed to load bucket policy', error); + // A newer load (a different bucket, or this one reopened) has since + // superseded this response - don't let it touch the shared textarea, + // the editor state, or the loaded flag. + if (requestSeq !== s3tablesBucketPolicyRequestSeq) return; + if (loadError) { + console.error('Failed to load bucket policy', loadError); + alert('Failed to load bucket policy: ' + loadError.message + '. Close and reopen this dialog to try again.'); + return; + } + document.getElementById('s3tablesBucketPolicyText').value = policyText; } + if (requestSeq !== s3tablesBucketPolicyRequestSeq) return; + s3tablesBucketPolicyLoaded = true; + loadPolicyTextareaIntoEditor('s3tablesBucket'); } async function deleteS3TablesBucketPolicy() { const bucketArn = document.getElementById('s3tablesBucketPolicyArn').value; if (!bucketArn) return; + if (!s3tablesBucketPolicyLoaded) { + alert('The current policy has not finished loading. Close and reopen this dialog before deleting.'); + return; + } try { const response = await fetch(s3tBasePath(`/api/s3tables/bucket-policy?bucket=${encodeURIComponent(bucketArn)}`), { method: 'DELETE', headers: s3tWriteHeaders() }); const data = await response.json(); @@ -606,6 +674,7 @@ async function deleteS3TablesBucketPolicy() { } alert('Policy deleted'); document.getElementById('s3tablesBucketPolicyText').value = ''; + commitPolicyTextareaToEditor('s3tablesBucket'); } catch (error) { alert('Failed to delete policy: ' + error.message); } @@ -677,21 +746,50 @@ async function deleteIcebergTable() { } async function loadS3TablesTablePolicy(bucketArn, namespace, name) { + const requestSeq = ++s3tablesTablePolicyRequestSeq; document.getElementById('s3tablesTablePolicyText').value = ''; - if (!bucketArn || !namespace || !name) return; - const query = new URLSearchParams({ bucket: bucketArn, namespace: namespace, name: name }); - try { - const response = await fetch(s3tBasePath(`/api/s3tables/table-policy?${query.toString()}`)); - const data = await response.json(); - if (response.ok && data.policy) { - document.getElementById('s3tablesTablePolicyText').value = data.policy; + s3tablesTablePolicyLoaded = false; + // Reset the structured editor immediately too, so a still-open Editor + // tab doesn't keep showing the previously loaded resource's statements + // while this fetch is in flight. + loadPolicyTextareaIntoEditor('s3tablesTable'); + if (bucketArn && namespace && name) { + const query = new URLSearchParams({ bucket: bucketArn, namespace: namespace, name: name }); + let policyText = ''; + let loadError = null; + try { + const response = await fetch(s3tBasePath(`/api/s3tables/table-policy?${query.toString()}`)); + const data = await response.json(); + if (!response.ok) { + throw new Error(data.error || ('HTTP ' + response.status)); + } + if (data.policy) { + policyText = data.policy; + } + } catch (error) { + loadError = error; } - } catch (error) { - console.error('Failed to load table policy', error); + // A newer load (a different table, or this one reopened) has since + // superseded this response - don't let it touch the shared textarea, + // the editor state, or the loaded flag. + if (requestSeq !== s3tablesTablePolicyRequestSeq) return; + if (loadError) { + console.error('Failed to load table policy', loadError); + alert('Failed to load table policy: ' + loadError.message + '. Close and reopen this dialog to try again.'); + return; + } + document.getElementById('s3tablesTablePolicyText').value = policyText; } + if (requestSeq !== s3tablesTablePolicyRequestSeq) return; + s3tablesTablePolicyLoaded = true; + loadPolicyTextareaIntoEditor('s3tablesTable'); } async function deleteS3TablesTablePolicy() { + if (!s3tablesTablePolicyLoaded) { + alert('The current policy has not finished loading. Close and reopen this dialog before deleting.'); + return; + } const dataContainer = document.getElementById('s3tables-tables-content'); const dataBucketArn = dataContainer.dataset.bucketArn || ''; const dataNamespace = dataContainer.dataset.namespace || ''; @@ -705,6 +803,7 @@ async function deleteS3TablesTablePolicy() { } alert('Policy deleted'); document.getElementById('s3tablesTablePolicyText').value = ''; + commitPolicyTextareaToEditor('s3tablesTable'); } catch (error) { alert('Failed to delete policy: ' + error.message); } diff --git a/weed/admin/static_gz/js/policy_editor.js.gz b/weed/admin/static_gz/js/policy_editor.js.gz new file mode 100644 index 0000000000000000000000000000000000000000..5a7183cc23dc1e5ba396283916830f5a6555bc0b GIT binary patch literal 11086 zcmV-UE3wociwFP!00002|LlEVlN-0O@4G%ln-3n+B8OITE4PX(O0|~c9GzHyN-M`V zrKn_(11=E_0UiKcijnub-|7Z1gPFl_sg;xy-+T06FUgq((CBV7erR-0r*N@mnip^- z%#M|?Ri#)SfEU6lJp;{U!L4X{$lOCt&n3<+trpZw>=i|1h3Vhr#3)`E~= z4swbAUnskVLTJ9ULP?X~nNIPgCm*b4ON%76+Q6RkV#@(u~gFR zHeBa$E)PTn_-4V2LdZ+7YhgTRVY4$9Rze%=c?{SeLvumwWR@Y*3=9qD^y5qF=;P`K zH;$#+Y?Z`53yClG4*l@1qUl&LqFF5!D_qaaQj4txwz6C!B_fjl!@v-Sx?qOCWOhB} zX34hvKkUX6*r3~GR=X}=sfp?G?w85#2lQPLM@RMG+MJsU$ z@1nL1U3OoFND=hA5hM5)`x?o z=FIZJ7zWt=!5H5jI0bTT4#tq@`3UTqS&(eQ&6X{>0VR2R#2K{@qNv7WP|2LwGpX#F z>kQv?^29crq%gmOkG|x3@+)=r*Fe{CW2YJND2EHqle3fGLCLo8^2JY2AN}p!lgCeA zzj*cT(TnFlKK(Py;p6ogHIRBW%%Fjx(x7?xIHDdl+NYUQk|$<5hes$m3%*jC_s-Xt zB$8b+A%RKKNGmoRm~RKJSh?dc-bp(?0!hlt78`Kvvtbk*?txzs1_f<7SfC@#TBm<$c722gB%|772B0|=4JIRWZs;3vz_IRuw(lVsyI9?QiN;cJ*g$gG9kI{ zZ{$fuG&IACqFNk&u<~iqYG!a=6kx&=16b^=RkFW@^CrFKXkN2LXrtAPpE}DHH@5I3 zA{EI0!zkG#o|uJGi2r9rsA3SUZ^76JiV@ z63?V=P@~lfO3tou2@n?eW@`^Q{1CZKf}3M> zd{==*?QglRdv{j5FE@}Xl+0`nuaT= ze${HlwYjnPu8qvV`K#x&Vw}HvKK*VSPu+^!1c*9T9`uRKlp$xPi@akN_~ zXuNRp#k8EUy_uOm&Stawj{Jk^cln*wPLlqf$hS{ea!kseQX)vBQ~^tscS}$ zTEhCpgfTpB&&GFJcA|P}1}jz?UO(U@Xa;gumh|OykP`UqH~4rxI=gdyrxvbl#K%YU zSa61&fM{-aS{{|G-+qJPF&X`MJsKY);CciAfcw*q$3glvcHXhH`aoupwjs5%4O8!J zk8*gzmg_*xy&w#Hge$jC9oPD5X7J`C7*ULYuU34CTJ83k<7#Tn7&vY=4P3v4>pajM zxGx8=R%KzL)t`T`pjPOO*6qMb@bFaaP*q*@ZnNS>W)}E|tuh>j)dY{>xw6eqLAb{7 zNXbHAm&bt|`LYLC?XZ#QPQI6FFX25ujK*LT_Td0p?PM{rT5Mq_t=cWuyl_J+t4+R} zLWACZC0dTzvznPR$o}yCy+2IueLuPPzq1x=-;ROyCqL5YXYlbFuA7SeIh34epH*`6 z6Z@wq4}7EG{Z7NKd7#w5O`OnlgsmVsViqi!)`H{uu#>Kp8Ep>W+ACTm3Kil>t|v(yZrF_zse1R9ce#Z>y?cHB z!@C#HfBM_IXHPCJ&j0)b=8(N!i(s0tyN>k2p+LL{uueret2y#Tws`lKP^Olx)kVPU}unFXs7L-^_G#p`!JK7I1j<9DxLxar49 zCuwwx<_t3Thso;Ya|T)X6TjZpUQ1T}{Z|BOOja55mMXojywk2GC1khZ!{oJV+mPj? zwmO&g7LCLnak?3)^oACt*Xn{`!gFN$kl?AdWuPx%KA+bn20g6$Yjo^Jp;vF-);c|% z!Xw3r>vqizhZW}q)BtV(xDk{!YAp<~DBtj+B=?g#(k5li&=#iO57hR7dFps}g8 z7O|;$gix`zwGu@~8q5TXLpUqy-w1@Xs$n~VGwA;Zuhn)^@+)4Vw`C%Is}}r?DtPIg zgr~)b{0utrxZ--jtk^^gt7{^%;0}G~`jQv0V9WQQBp9yA*&#U9uXD9?*Iip15LoDy z=6fwHCxM`6c7|)Phb=E++g4Fy3x_SxfdQPqe3}_(?iQUL3#Qf21ogj~ippO#3SFIb z@R5-v#)`6pLaQxyVQ~OkBN;eocE!&KfCz>jwNYHYwO`CW?=A7u2tkA3}CNzWkDWVn-)oZEeU?5 z6&i%x?kpaVVQ1LV?pRqKfK{#LcbedfR(pa-$ZHz<{de`WI~7}SU~Y+Xyn^ASvXH@D z`Z9O?5UYdZ{$0pM*(l}5IIBPdZ2CxrTIN9pfBWtBE)%(JO|ynwYEP|4S#E1bPaJc)_N(>?>B0>kOlwnV&&dOk(=C0QNe#5+wtZ-KcMGWs3rY*)_Lu^@y+!S z4r{irwAeVB@a?z6ZDXE@l-Pmj4gWU1+xP6J?#s>om?j6wb0uo6$h zc>$h`RWP6iyke#(8BubH`yN^%X>?aa2~opy2W_aH|x9E!Wi26;IL$9LwPqC!LG- zIhQ+5UCi%v!PJ&M*K>yIIuykRxC{44NoQePLC5(AMq9QpNTp%$n7SPFJt@j98xS+T z=^{OJ26YzCP1js>McoPYnwbi^t$@<4R#u@w&)3Yn*vpq%ZMn9G933bxTJ^4Gbe5(Y zZFN48bo6F6>dI%_=WoAlHPs`FxNh6MqGfio^Y)v6Se84Km9xl{JAi}YF9e$V6t!wO za)5zbsL{!x#k){@?~|DK(Q2Y#B|fC63ESREfo68?Rv=jm|5hyDqcSPUKUYSVOiE?J zZ23~G4sNvdd4nwA$P}c+DC~8fArI#5*?-uaQkX^3;~mqE^wftzpC&uid&lJRw#4IC zdnB_aU5RG(RZ2ELf8OdA{lxWlu{m=Dd4@;*#6|2o>wnm7Tw&f=kh&x(%&3651M0g^ zu9*)>Mzf>7og3b%rw?JFgyRIfG`y#;(<%Jmb~NPF z6Vx(xYc>Z}+qUyxF2+D%Vx<+^lJ^nA_Y5%WVofFvExo!I_L;QpqD`g&2Dpg#llnL~ z|K(yZ!$_oS3e3ylC(f?8H^ctWBQn5!go3|-{V&|UOVF+(Pri|s_8#80)HY$rd_U(M z4=#4YQT}e_ho@l9rX&81cf=iR(IeGuS^D-{z_-bRiL?y$x%#?k!1^0-3tUA_MievfNDTQ^7lOd3EE|oxJt3c~;ed4?@(|&y4-%u79cG+p zB3@r-jZgj0_P5npo~iNpD?ga}{g@tqUYWtRGK+#?vXh9bD{ zMtRBQrCr0rwtMYM5+PSO{egResciKs$|x3$qR~z1GREk zpaHRhU+K?ZK}4WjH9)9vw#K@}KcEZh4+oUwA)E-ET(oK?4#Uk17+ReIDT2HlR_@Fu zA*T+I*^9D3V+Moo2DlkyvcOO0zg&P>D~%?RBAV+XVT=z^k`G2>hwC^4JVBKX)^?ER z`QRFA^ZSOrp@7i0*MXD+Lh_1nI2}Gp@!$^NXw4boL9bgy7Kv3RP%8w6$#7}ivh$uF z8f#7UZMCpekV&_FeY2g~GTe zYq-sQjsZ9P@hAk1JUwec8^nZpLu1@q&F1lkphDQ@J#VByt;9GML=-a^Ec78JPM`o=xU%fyb#6IS?H;=wbNkYCQ45l+elXK*};Hi z@99i@$qO!*9Mn}U6#F%^DEuHyEDHGdk{Rv}PZ6Xo#gbr<_x#WS&(Z%UE5I57RRdOB zF}bXUFo1>n;G-^T45ijWspQ0o0NJ)ikXN;XBxu<=DX8$ua8DhUOxDMTc-&Em>@+qz z(>m^g0PH|`siYNhhooI>S4GX8E&HB1VG<+E zov;%q=>N{G7MtNHUxYy=;}0yt!TBjMHM46aA{N|cuC;Sc`QtE+FGx?g>J+2$5Cm_ze<8rnU0 z7{12!dKNz1g1@er(_ul+qWWWsNjhedz73Nq`bXGAZh0E$>;;DjUI-B}En?{8ZkP+A z_UE-FryF{N2MgmOX7Hrha+xR1K+PEk?f7kQ4Z!vuceS={b7-@mn)&JnH}}=YGzt_? zcA)-=5K!aYuhX+==r>|0r-*ewv6EU&X+Rf(8=AcRWl9^iu{LaPqYbTAj_bq)+we-{ zg*~{N53COCpGL!uJ?s=Qzq76VB=VYTcexHC=4BDCF`7R0GC7<>sU)WjsW3s8uy@@} zYqeobQS0nsoKV< zxV#H3-e6Q?=Ct{B8&mj+^p04T=@g!>I*bs;?X|`Zrf4@7>q zwA;y244&Uwh7D<(l*i{g;Cy2T<-lOV%#UJyg<5uzK9@fr8J8O@99)VkF55RarvCm$ zAcZ_l2S5|tA*_k6qBgg`?uLEpe)q@LMzx{<^BOm~wCu8U)?WHH0O%^|T(mkdo{Fc>U}rm_v4d3(JxjGan$fIoa$iF9r|dIOCn+ z2AGrO^gM;r)wSB^6fg+Fc4Cq5Pqz97gpdG6G zlQ8y`+GFHzxQQi-591J~okg_5pY4P4QT`7lkrZcym6;;4V0XBpWa;(kDak%b(o;0W4jA( z_nb>$rMQ%InZaPMw8d`zp^xtRPmL~EVM~rLd_Q<_1n#*%UH_?vpuY}3 zwx~9&9NnMN*F8jBc(G$W+V??&APS0BCBz?aDm>p&YbQn&x8k+itGVy$3lr`%n((il5dZy3Q-q{@W~hRnzt9AE6Wu#MH;nQD{(gLR zj#z=){p8LexD7*!r#Af7YfShhmqqGL|I0$@f@^nI2t8Z`lvenBe~g+30)E0s4&<%6}F8jodFLLK5p~;e!2y?W}58rYf%xLV~xJn?xU-pAqa! zz-c2J(>P%GrhULb1}7X`#13ZMRBWUJ%rN=0h)Cl&P`IrO~CUPzcqZHv>xYepBLRAQc$jYi#j96TH?eMWN!MCfm5Uvf2a?FkG4Hzh|Z=;H`lg6F6M)VsVI0CE(jl!OWVjXSX@v!p3f8 z-D~~)JoDZ}`hK7Gy&A)527X&B=Vw{?f?Fm^6B^vu$sgmrn~Q=&BcZlj-n?5gyUhmq zltA;_V$+`rD~iI@Z13_k+@E^VJq?G9ASXdf8$0nXD7y2({~7?L+`ywn zuIGb~*MkQs)XBBv(aI{bYu_%?P0nripXp=1^briA%g1u5Bp_}a4`JE<;1YF#K6j$P z{i)pQ66XE+R?ZqnGN@hW*6P-=3?4X9b8ap3M;@cbsGT1wgib1FRBPDwN%_`Mpy zUC2H~d%Wy)%^?0rf5z{jk&RyVf_4ny^&*(`;7(ftj-CSC-u8d7fhT+dvEk;1V}zz@ zh)?)gVHy$t%bnIftX`OH$qsee7+xit@p;Uv>k5Hf>VThu&O@d-pN7Ujsf-PoTNvel znOe4(n7y#e^)w{H;jK^r%n>ha918HG(wn|;fYbqfGZ$KQ*zaTM!+CKWi|(Qb{%gne z;es4qrO(T9nB}d5iZ}hz@HR^XsPi&?fQ$=_k2ZcP?U0uk!Ehc@e+{!*va-<_?tMQ> zrMhSyV!si^hqoh0evRiLFb7`dq&w-g<5V^{%=Z{4W&r^HH|9t{uD=vh+?CGXsd!X3 za=#2S8d%})l_yP1?F(_H30nMKS<}AG|Jl5$mfU|6j(8$|MZTF(wUi&B=Doxlk~6+Z zw?HpvBg)$xWoJBb9$osQ#1C(X?%VX8jQ;1}c+R{{&OJ1uKCe5sA}_+aZ;r$YHnKD0 zHmXrwB#?5R1o<4QnT1AGDdWs;u@M&UFjk3n15F?19jIx(LfMSd0A`i11U}})+~}>m zRw4am%4a#^+ngn@$(Oy;6ZC|xo#vXh^4l>3Xki3D!-)$;aCzC^V!-MMm8n4Daf z-+7|zpwnhf?fL@siuwD}1w}Qw$~{!C2t-u7LzwDPo6_|K>i9mYzb++wuI@%otEoHD z9#@4RVkrv5e6&7pHm~T|BM1^mFTi1jyaBn?!91H)xjEOPvhH> zLbh*b&!BN(ats;AONv=~Fs)=j&Cy8iQs5mMQg{aD$8uYK+7Lgx^F8v?9nT3f-f2Uq_`=E&ER?dwYPQW^vjq}-p&wB& z@>5@CiXO|6!Nab3^ts~W1%*y8Lh5-}2rs!W7ZQZ6R;H$P9ooZIEa|477ME*Z4-Odo z`N?Zo2}%?kt#YF{kGxwk-N`QXf||w^6U|ta9ux;eL^L5i@t2Yl4)LYW8CEU>ny>`a~J5Mg47I` zR)uV>v87@~Qvjbz`#)=JVvX$@)2vyjCmTcRz5mX&`3rMy+$k7vD^4Eq7>rd^5sgT+ z`~|oRSx#RaD>2ZwFej!ju9$Ru@{al<<|aqPd>Jp~-+eOwttYC7dFGRyuG^S_n;o^n z8{z8yM!JGZ-z~b{8*}yS+-54eH^XjuXnEqcy?1!Wv-VNOzAPJ8+4y|0`?$`$_vY=m zHL^IVUR9rI78chQgF=~20!#GcI)9)F9Fd@J(kf}X$Q`Nii zZhXrl5vEbH?wmk_K3Al+47b_1gzY(4C@CF1FS#gbh?P={<#ksFvHB@8`&t4 z#|*{av^ETl{mPY~x=l5BN7foe+t+dmwCEJ@$`_aP0`74*7qGN%+^!a;-jtL|Q4;C8 zY*Z>y7`mH#EkYRu%IOvRtW}|e2;jjAYnkRCl?5fc7?j&zp&bfdGIq`bQOri!wx`po zh80X)y7$=I2PH#IPGk*C0+QrX_PI^iLg`~rl9MR3+({dIO#TujEnYXa1nF|4ZkH+5 z{>&laAS@jVw`oywkaV)3pv8}0czDQbM8NA$omSFa5}woBi&1pWlT zEwvcjYGv}Q^TVSg04^s8Z9Ic2lkA7BP>{$@sQ}E!r-kLfq}ycqm86w>MD*0H`jU%f zzX#Iw3r~Q)PuWU*ZP+SW3tAO$TKHa7{f1JXq)Xs{sp25&OrDK2d{M0+6a<&Offv3Q z&Vm^cT<#d^ib-MC zmC&^0IsS(No5!Z^4V4_*T}= zYMId?(#F*Qas^Qub+41DehJ*d(<3iYwW?9@vE(_t+-Xkrh*r$l$%^x$T3K9~s4Ff7 z52@3uno`4?t5pX#uF_ZXBSN}PdvNJ7LZxhfFhv|Ru7c(z(*?p>EtwC_OKkY?M9xP} zCJIh{)9=Bx=jdpzTNBst8K#Q(j9fyl`bCt5VaY8Bn8WvHAmBc9(s`VLxO+E!kY3f? zsn3Dm9xc8Tpi3HWcsa` z-`?pOZg<<0($t)~x9s!!DZI5^g?ofwJ-Oo2qVLWn*Tam8q-Nu)kHa=2dw1u}c#YNo zVpIU;N4wbs5IX1BCv9?&PHQ`pC=H$%KBc@_m>eS(BPQU|YTKN+m8W;Qw|CZZ^?X{Z z6tyUx+$oob&BN}6Hv<*+F2f^Rgp9&1a#oSIHoe`*Kl-G01C7!(|-X``sRcUM{2yEK7jT?rz#Ggnf?k% zq>KqAxISt0ZWNa3OKy{RLT^Z5HtJ1pT4=Tpd*V1f=vqkYy)x6yRhpk5p-IH<6T#xN zRQ0j4ZI_dr3~8A#^!&nZth16W-YUb5t;6L~>1wiMQrU>=2tIx;my)q{jYd8#%&rgE zj`32nEya=#Ddp0=+t1u-*3J!(6~$A_H>b=*=dM_48fto9YYyrbK79f{DLV0ZLnlQk zo-pZgtf2$Uv+Q3p^-h>io&D5>k$ye=$}-Ssx?JjS#tjL~olY6b32xPd)0P%>jF&VpA7kE@{AEpzDlCC_hK4(TS^ ziOZo=xR(BP_3CEdqb{;P!X2o8pJg3 z<(Ftepj4M)8Pk%S6WA-{(rK`nYE^P7k}fj~Yr!?s%e7dt5-5nypTMFfng5rRXnQnW zbu1DoR)4cFPu(&SX#pD-5Os5XN0J9aqEyr39hrcR+a-2!j@yFD>2+SrPu? zYS6ir%&RrC^?@~73mB4(;6;6U>~Ux%q2L=P3oA%jFnQ0mZA%x34aGii7(S$^Dh;A}v0L&uDK;Mb_YF4Mg=-1(V={Ud z7CG9HvtB}Mxpdn{rsbFjx;Up%|0{kZY`IK7b3MjEb$?4uF+rZg7?!Wef}(YOu^p;5dsN{g?=hgJ=_3oZ+9$DGMC)}3G07xQe)rwrXAnSN` z9PsY_T9rXN@@}0-n1g2u%E8~I%PxfDJ4;!Zmf^x=PgFlRZD`t08*YbGwlisMkdbCe zzJgzb9^wKt$1ZWXR0aR})l-as|s*vunu~h%IR8M%@x^ z@hHM7M|U=OQAJ30v!o>rr0`=NI_J(tPt?^u>-kv8%+gB8 zz-lIq;L=uiRJL4im~@e7TP2K=$?97W>Qye++^_q>)N+4D^iiZG|6nON3pm64_0t(A1z|`(KC~4IwS^qOEzSs?SIN8a!6fWvk^>o`Ql<0@5;(7l9 z>I$KEs(AQ0{^+J@2AN}42G=QxsH#fX(52iEkk;RBsOHs)Zs3<8wgKr8B4>x$G;78B zgy$MHm%hX(+#@irdh+J`x9v`%TwT;1t@`2yeQyly-c1@vq95sQwGs|wt*O-ozOyN< zO!03nDrlOy>fW6|rp|p08nP4atmy}O8J|HG{9S6T+FH53jZ?9XRx?q$d-SM_6CuL} zFN`{;=PK|qpp8nl$q5TqDHi~0xGa2VB!-BZ$ZN=4ep&o=;nH5`t>AQ2yjeYA3GTPz z*(-IO-QZg`8Bz;P+6RlF;gHnpg#%HCfge73nu%pK{MN|Vc9ke!a@8Z@?OdVlTv~gehdHXlHT%b( z^RnMHc1XOv)j?w#!7XSWTOeM zy3-BknyMA>4}Q_40|>GKPtTuGO&K%36Q6qU!eOffYtqiNuIU*Am3`1;1>WvlMt~Rs zHsi(t$eLYokg7TXA!oYKqAcm&$d?B>Yp^nfnYUrfK1e0?ZXYIjq@6TqaJ*wl5uVF zWP3f`W4TEZTeDL$zw0laV$Y)YkD0U|t1Khkt6sz4bA($;Be%O|U>F)KKX>E$U?c?E zgIamOuXDf9-A&B9rxzFJ&tCrYUnWzCvJ0 zyatwp2n5bG>W3OGq`F=B>EsL+L;wlpip236Lbgm5yhwo%t1v_%W-Ik(Kwyr^iY6GZ z0hg&<=RiWXN~9Q0;HMSgkub7AE)f&mo=TtpV0(1ngUf+R; zg)8+7ND=|NM1IAoL{aaE~I9o0uW!KW^=3%Rj*?r(dtA_cKuFZ$dbrzSmIkrIFduda4md>tw{t+!Y_bI zO&W|wAQ%v(GfbzYk((>FiX%u@Vo_q}?;T4d^P$nq@|UV1Ay4s7n8LkAmb=AD{WVAV zL5FzM18NAz!Ko?hV-))A+RvpzVO&pjyv?_a8l(9RQ zHTEj_-?6GR)&+vsFfBoPx}McCHo=&!AX6a92haD9&QB-V=S@%m{r2qImz+KjFe42Q>_rW{++r>RCjwWcZt zX_qDn02;K0UE1YKDpn-UN2*Z8_AyGcXq0$O8Jp4l(nlf)pnaLkwILcvhTnUU| zfgEAR*-{U7qib`>8W^NxjuXS|%6p0;hebFhfrLvE(}+lnfXoR^L{@P929r5WaAGL- zL)Lc?$S;wP1&uHVG!Tdd5f4-3ODY6qiI~h;AV6SBIFSerB)Lv;s8wFV%KrViq8wjv znuIhZ@nMF0$dVbI169x@j4cBSe<({krrM-bty>zwg&ax4xSWtEI=RF|K2!8bP<3Fzt|sSVveYF;K*Tx; z3lACwc9R~ACM=a&OkzytasdygaNn(>{v=;}o|dF4Oz{-R6`>MlD8t3T_N;?LlG4MK zKrV`5?*|qUNeVzYk>6unf-8e3(8x7Jc3|HRnP9(65-lQhL7da|H# zG%zq5P~CW*Zy;1o9}JLl#)mB;!D5`~LWAH$eHejIexYHEnwV*{AmS{I*i~{AjKF~P z<70P%CJFMN&whCZQwSbrJkbQ5-nsMLbC!V~Xhl5MJ}%Ldjp4&XQ~JALdn-bJVDvPJ z@U3yWY6Lm(|H_HCvDAstqtD3_pC;+5he}aZY>naovf1Fg@+b_do(H2A6`>{q>#F`y z0ROFw6qW0Naq}f#;qchg;e(2HtN5Ca;&>2D^3IKo2QoG|kI!Wi42$u2zLJt9)e&i) zdHNK_G`wi-Q!g*b(Aybms@D^xSp>>SN#@**-MO(`wO2tu;)%aa^}^F+qgOal24di2 zRBr1!u`1({aZ7HNRrX-%ONL$^=p(Lrk*nbXZWW@M6;>H$Di4bC!!}M>zV4nlA<0~P z2nOWyRu2p8R~{y)063Sx6RQXkq%F-9&S}J-i#uLfua?n`K7~<(x1@FKfnIMw` zR#CVB>hlC#3^}HZ%c2pFl{fR}#8HRd{u8``jdJ zwxL@`5WrnC1DPyQ2r_q7-loahRqG)O1Wclo(L@3@LF%goixD^y!4mzz3=LQkDUk~u zcTr9OPzm9Js94WDhsTMEiGy5_1eWANO`H@2mLeyTakye8YRy&>$V}>@2s0AO$$_g! zGL_I-|JjNp7#`Q){Y(?t7n-VL8|MmUUwvgkt{7|GYPKHrf^pSsS+a0QtOCbQ-IydH zHrFg(yY(2SbDF>uvcV{md8R)O-sd%RP4b!}VufEE@qVf@VnNjm! z2E81i3@x+f>NUyP5Hv&CG(ttW1Xme5YIv?wn#}bGq!Q)~1<=F=NX*L71Rk$w9GM}g zfKs`DG6G?ihWJVkahh4)Nd=ZAc-2Xz>pE+7t*QI|eMV))iF<)homo)rppFxmQX$ai zEW$zXD5s7NwE|0Wg*3@mB-qRlN~<2i5jf6NuzLdDh@D~R72$fluQ?VK>n6+{ZA5~=qltZKj=6eVZ zFYg~JITa}hQ7aPdPirB6XgKwqPA~`#V=81&gK=bFwAL&d5Kia&3eS_6Vj=}_B;mqP z)wBde)}_PH082&JBpM-$YV(}Dn#1EvBj1JKNOf6{jy(IKL(g)k_6+p+pjs)@ubxS> zvd$QcYC3%AD*1BO^CQJL+I_}X4fJVXt`cxww*>oI&@P47Ei~{tIp;)aK1exL;-HLP ztPGyLD0OU>#5lVW$l)SkSH>UG`4g(}qa1_$Q zoH_9d6B64Nukb~M+;~L^$?jMA^hVx+GDGjKcp zxNB6=?>ebMeSzwA%(jR`<~XRbEvz!Y%$h3|`AToJ8>Mez=AH$ZyUgEz`vj)%?=mrY zLwIsjip(hE@=^8)n@@g%ze*z_^DMEwP4F{$Gr+xK)*LNg&L|Buu~Q|zS^n1ru7!R%%ySr2 zp?hswFh(K}QqC@Ega-9OQg+jYX0RFvO-mmplImSD-I6GleYEF^ng6vkF<%nz?pb2` ze^cgGJ>Ph@1g`F(oWY{*}SfV6qWGjcOGuU6UN*!}M`tkl_CXK{c zQl!|W=fbf`)-T1|0<8le8u==`T~md#DcRFRZ-FRVQtezX46)gg;$lZ`95Y(@v`4N* zwew=C*)MjUjJ>enQr}0246TVp=ltu33&5F=+sv6g2iA<)GMaU7aW$=QGSJZnO_kC8 zxONz=-GS8gtkKgr?m8d7T{P*v zXi}T3->#Y5u9-AW9sV2EOrDzDLnyRT)2c~Uuq@}Cn-F%1!)KX}<1)$04aH}+HG@?( zpY=S0uuphCBvQEmS-7}f)qZb>=F7-}MtSQbmpYVkHzQUd*&9-o0%W(Hv? zAbWGn3Tgf*GjGf9-q|7ZS-vxlI4I1=$Y#4`LWb3YdaePeVrCN-p{STI∋Q%#K4A z$0QX6Yc-f+Wl8<2t}Cf0EoWyG;JO{3p`jHUNV0>tRGPjrLV(8<&{$vt( z3fGh3mn*$XYDwZaIPRdi%&=1k)>vh7MN~U246mtNU%#_n_my%VJxY;Rz$fq|V+)WZ z0(_gQ56KjH`P!Gu-$1rVrEYUC-Jt2PiY)q44muO~5>01RY`hDEn}Y*Ko_1wMb-%KUE~hHigh*8PgsDoNs6pv6R^W+znY-D& z(Hh&;L0xo|S7#bee^7DtwTAsIQJbm~+)JNt9K)>w90V1=3%BT6x$`Q zK=B4Vo1pBryUK-9U3Ra)@vOMpkb20?&F(?7TlzP0p^vLBHYK^h8iccTW01KF=ckyR zlNdzEQY>UffIdC{T;Cg`iz|a&{7onr-XQ6V%>M)Om|(Gt_Q4DzG_fT0Iib0I3+U2IJLi zv}(qxf?2b*+BB@&Y&iwEBA490tL5(9_FG>ZMc(&35NphKxljnqQ9dtGpfvX}lovH* z*E!JT5+h0^#%qv__oEW3mu?xn3Bb+d~TE$ zz#R3bUaHpe8FqE%RClzmrwg(q;qDs2JA>@*&USHS+gEx9!Ov%BFZ4hv;3$@^#BjJR z<6J{(PVBDm#46k9P`3K6HWRG?XBEWZAv{uDMYH@10|F79%}}T58^VtuKT(b)nC0VR zG}PJqg4*Z2>Fdo>nep@j3Hubti&jRN|0<7np>rWxuqsQWME`Nvu<0_qb5TI z^HDX6$$V1L;g$~iVmjS&^He=@pg%XgU{sRdk&2pzuGcndx&V-? zYPbu*maP$z=@F_g)R}a*L)THmrO?{T*4N}kt4>$3(c_)8;--_km07tRoUTqsW3{aSvcLwC&;vDKELYckoiTt-A*BcJGYHs`;BCcK)x7UEHZfDnct6lli3%54w_}K$idIQX9TL7vHL(L;}nK+kCU5LD|Z`HzP97pJ)~T5%x);6T&B8- zXY2}jNCZAZDUtumf1q9xOp!8MvK;fZH=VPFE@7AXc;UYUvp@oh~q`vb<2Y>Yl6U1;-hEt2eE_ z3f?B;aWH~F$OT8#U&->XWGo(xBV01`;7SCqk4r)taH$3ZY*qv8?kdxi*0Li0L*-&% zY7Sk}WZnPW>3+g0f|fUywSNR(zBAu8zt%5vr5pF^k9If%*Ej z_+~7Qc;F#`Sj`*)ExXBdJM5Hm5gP?G1?eR#sRKlps*EV*lrwtMplxW3xiLtQy zjLTH6y<0BZRk~`?=vcf67da<7Qv9dDJohG7ds#*$NTZksoHb{N5 zN;d}Q&Q1!gNI~zZ%yhk*Q)CwS{VTBoi>>-67YA9Ob5zxDBLk3euTr|6_vq4~v-4OR zS1uE;H>NsxWM0Dc8bhtZTiN|uPC1IbsnqOx)eujVLav{w1Jms8X8+1+Sv3!m8){UD zVE_n}PgX**Wzl?4kD?TFMcc*718&py>C^E+TVvH3VAfjpu!U;=)A~MJ!ZrD2H$uDm ze(TScZa($DFPb?Uo2h-afYFNPNe1KH=GZw%7^cp{C3$;hp5MRcJpUK2pJhh{!ToRk zzw`Frisr@pZ@&GnMELgC*&vwK*2tr`@X&KUlCz^)l6i3l{BHu`0@u^*G;Wea>Zj|+HpKRwH97Z$ zCk3dAx`=6rgL@;@tNM-prdDxJR;`}u-d(sq^i%T!*B`y#3Xuz3mtKu6kbdlbKO=M9 zbXF(#avo0M%XfD5&F}qjF)GH!#u@-E_~?2~7+E0t;-m)is|#GehAB9wI4E=*532qy zAMs5%GX_hNtaSqu_=UVRsH!R({V?|`COt5&xE>0KZ&j!D3Nc&BRi4{%>RnG4hpBx` zc@J2XbHuIib*IW^H|VuMsJ+F(aO=UCwVOLDyHEGEEHW406Q1~U?roM`??Atn<&ND+ z<{X2NoufC`r|7-gjI>OT;G1oEM!O@h?FhiR2)gGi?T$ue1*AEbsnenJ@a{U&71X7x zeu_rRwIBOEG^63T=e*PAoRb;}@^edu-V@S3;6k6_ml31>$&7R1yG*0Qg^xW}<17rX zx4UERo|d-H`zH!#tk2zcUPWKeJ8m>;h4cO|Tnm_%&0Bu;WJ%J&g*t}fB7;1f%xEl; zXHTp5fhb6g$AIR`yX93Cx=C|%@RD8PjqK*?H{SC_^-pcczfqJrDwy^0N50|MHAcPx WaDyY?!mxeh|K9*Ze+O*tssI4C;Ddw! literal 5826 zcmV;z7Cq@7iwFP!00002|Li?$bK5wQ-~B7Fxv7wvNOTg{Y~9*XQh7K#xpf{DJG)nv zN+mD}Nmx?^7l2}G9R2qzJV*i{NRhJaBy-M(SfYSNqr1^BG{D_of87DUg5w#aC;`WN z-~^tgh=Iu>i#aA4Ofg@A388?`5I9Eg9HHdpF?gEHaRy#MHajJdCeaS~b$4fHcNctk ze*|)hCinu(P?{quJF~@Uf+>nQp-YgUJSEFH%J@z(3}Acw8D!`k@gy%R*$a(bn^RuVNho9d)J^B6fXYlPC2!a8)2Sks9os~pDPvtd9V9It<#06|Q zsb`D$4DlBzMI6bW!5CzVG(GUNdPhlW%XZij7|}qHV#u!Zi@Kx z2qrEyn%#H=K7z}TTxHN&!v zIYB+x$KZcQqSHt=2tI*v1=2Hh-AhTMT3oL(%rQ*yAIMl>O3WB|2d79bo{|nY!~A&f z#1KYS^0ifz(K$FJgfmWI9?7R+$@MAXhba;tpDkY{VUWnK_As(bFwk^qT@QVRY6Mgp z%32DW3{e7*pba4)=NY0(=*_jzj_O;{$y^8q6jM+d!NnB81|ml=Ne;iFj2~gfQHE$3 zuo*dzPFXaUErtNHWfqr;7=-4K9*iQAi*_tZQ8wi>@MsJkxLw3QPM4mi6{#p<~hoe=QErpp@P|f>dNzc1!BnK83+-jgbrFnf}|*tjl$qi{80jd zv#I8iu)Lv z$Xl@KqecUpF9c!i|4_xMMc0oPnWj-5di-QQ=DMF4EYSRA>ed@3{F)O-m$csTaBYYwfr-s9)j2HN5860kI4)b_1cy_06AYk;kp+#BhXv+O9wv|+Wd+HEZxtHt z+orEQZ)r|n5;|{FkUl3#^fA?B1<9OY_0;E0El%f{d)z4G5(z~)MWXWyG=YnhyPnAw zRlW^USo%_2D@8BGIN}t~!^UpP5Rca?cn9_nOkm2816EMD1nTnyTns773FYM=9xJbc zp@W@f18ex@U~JiHIe*{8#d_&Ud?B=jW@sU)fDFbUhm@g{VwA8P&qFWOW30mQfp@+N z^n}nkK1 z%4zP)|A&g=`|8h7W4Ui(`^5aFmFqqTUOhj2cKH790a)q9-X2)=3@Qpb>?)aK!C=_n zn$8iQkz^kP@7^At1Ve8d9gOeSatoIr(Eh;aWSOI29|U44;TQ@fu`2?U0IUXnsHY@Z z?t}k1e)}e3oZ@VXC(BUNe6Z8S`Q9Wrl9`yY6*+5i*GQUqYOs1aP92 zre4xbv5ilh>r1#AEl^^sfhT}1q>DaTr0LQ(MoJW+BZ>sk-07~5P4uu0)7l3CxThkJ zXpR_zQ&;7!n!MfJU2rl(0A)!|aK-^r|5v>wB z>pxSG1Xfy1!TTL&ye~A-$286sW_RxzkS${^N7ZS~cZ7;ztCpohVl+5#`lc|8QFG7o zXSW}rc#4JRqjSim@a2?n5|b3%1HtaD5E-|{j4*D;<9g*H7E^qR4hu0EuXV!W8DTO9 zX_Ct|1N~J!W=CS)U|bAv_pbg_xWnTy2#%h%69!0DD5R)JFO!KPlvF*C3f(nXFqA~Vo3T?2J%=u^f66 zV!CG(r;xEXN-hFHpppJ1Xzt_C@eKhCQNd}<1TQ2;Y6A+hVwxUs4K&oFT){`pA)i%C zqz2{*2zI|d*cEchau_42NTfe4h5V7?)ML3%73`*%@t_7{U%_bYSq{LQ$@dkW=P5=R zXTqArGeuP`O_0~6L(u?LimpjCVv^M2oT8hz%34&5bUN$$} zrHrApbQJQ^oH_Xll@eQ*ukdAs+*Z3hmPxhih{w z+P3)n3YZMNq;)|5Szuasjk;;~>xfr%TD42m`r!u%S}(Pje17(iF)zu29%ne z$?i0R_f?lRwdT(Nb{au8b(Gt>jG>TTUBYsPmQ4OQD0c2eqx)@IFh!6dkW=y%CrF`Q zO3G%sP%Tykp()|7@`v7y!Zo!n`cHeQi~7G->Ef$^+Pu(3{@+x5QZLrptOmt~bAweb zLOTiz0ddwXNi@=b%DSur2ih~!i!h= zUNpPHma{3z9>9G@Y+7nt+vXJPxrzPeK5Mg-Y-8itlK6v-L6I3OML(uTVhmw{@kX+No-D_~(d2v9eFl zMR%~Tb*GLc1^sycJ!=(GR8gcnW8lIuN!G8j*Z?gv5E6MC-li3*IwpFReHBtxjU>jo zS{`7vrn16Joj7K+^lA59i)xl**hLp+d4`$KcB$_pghnee=v;ifxeS>4b6c=+Jp~(* zx?4+ZNrh9CYuspshMdQh^H}{-^@dOS17_;GXVi^({P`2=X4v?1=F@u`g-zqY+iZRB zY<(?Ay-n8NChPxSC+lCSQZGG^3S@kY*f{>xG89oD$(90u!7~qsXlT zmW}H*$n%9flro2D>U8jHF173gf;CpDA_Xx{3&U$F*EerH>%LO%qemt3G7AWvYqkKG zB>-LI;twZ+ymaX+oo*mo0<$TiUb;2j4Uj6QnzNcI(`vMu+NxGH-ND{}@#T%5{BkK# zia0rzb~PNVz6@&MyBWrH2GPT^Myn|E{W`bZN!zq68<&Nh2K8@dR=bSlJt_K|b5TmU zTgzHQ)&?ooFehY@CH=K6n6uHI)5}%zD|YoSn6d1>K=U zd!LY^m{93&jWUwCW=M9LQ8WQ#V6R*v^B^O}2}QNTy1TzzqAVr}`tbhMb286KCU7#< z@yhV-{jDn%yV9D$-%kD}6}Qk6-lK7G>+L>uro<$(DK&u%OrR=YlIO=pImL5Gmtc-Y z4}CN+|6M7! z<}dBM#=M&8UBw;CJdGI}g@@thwNWPduBSB0yqWQ~GU_@jquMBaTNu^3FbX?MVmozF zCe&@0MVYW~tD=71s;D*5<83w6Z8g+wHPoinQ0rYx@B(p&(=MK-Zdv*o&3;)!GTUlp zIj!Z`?CO-OLi{Z0sFt(y@xh30ku&MxYu=dzN;X~it0V9pu74MF8p_neY z1;v~2Y=W}csUjDOz3pzn@$9(wI1%-#<|ba(*(-CTeoZ1aAe&K9A5TmZJ z|9eVKVG3AGa#YF;0}F-{aJmE}lkx;+FiTQISuI)ayPVWnm7T5!=yl1dFKKSCR$m&r zf4W%bnx3e?V{dY(LSXepSm4UqzBoKOJUI-8&9-&mNosE=>%7LaDQY*|%+{PWwQpck zKrAEHV7!`*R?S#hm^E9gRl~l`noC#p$Q$1$VJy9yl0IFQ+Fb^(AW?=ufxCBArr%%J zdld>AU|k_=78GX(&`HJVZ7E&kX>b4eM8&6Vw6JWTyEI`UES__sg?gb;`-+}mG4R5b$1=w538HNzbdz?cwtK)_>MEMW zY46tkaOYBfx3s@rxapSoTP^l067HA|pg_``zbUe6Z=4|>2D(Www1~BK!+*OQ^FNt_ z^5zTH>L(RNU#Cm8CjM_$IA$nvg8_Hl05=D&ts6wmk!q{HX%0=-lzF#BqqVO6lu%1l zSl2-f^+fX97WLC4)U7)zdz`mJ9 z*AUmMa;Oc%dQ&$4++k8T*}kDO!Z*GyZW9<+)~eT(zo>Ta*bzBLG=>ZvA?e;&^ z|M0ip+EksYw-k#p3W|aC_bBiTdMC37)hswg5&)sH-yQD^jes*4bO&9m>|nQoYu+6s z){Ry~5zAA|!yqbbx49n05+M`SzE-O)o;FBaP@$EguP9~4oY6ezOK%l+#w9@}0T`sTYeC0*7@$r7d{-%Ay2t z^oLM#_eXyVll~px8m6=LX zU7I2^z;9oPl~}CRKZQ8(5}kcpzYP^YLcL1qYTlzugU-%lZC$xcyxN-T;E{O=*J};6 z3h%nNqGDCZFCiWZg&lil7c{#jwcd{`B*TpIh zE{)s6CyiCZV0HwkN7D~msOG`Dy9qQ~%qdnR8YHo5!V;R#Z9iv zMvXGX^Epc1LHWi-Y4Y9kEUHYQYB%sGQ@zWRT!66&GQwGcF5XVUU|idgNiM)6&yjEE zkO+s<@-2cN7y@T#Io1~p3O#&=maZQg`4eW&K^gbZx&UOO&Qcts@cvNDs{T$$y(e2- zd0*=%rgslK82G7qhL+!b-U5*`w5+@uQy~4=eK~n{Xxs%we{a14Q68yill$ zE-R%%v{w=Jz}Rv<1Q6eSC9Q7*FqNG3+)OxcdSN0Mn>R1^fMs2cXylcAsNdH9#*{sQH1k(#nk?Je7T^YZehnmZPIl?5L8kIzkjvFj%JdLC zT(_&eIRfi$HJP%Y`(EVcXjnTS&HIy`?$Oi;Z75wqUApQA16yt~-tIZTh8ygPNvorq zH4+p@F$dmDA8v5RPT#Ssh}gSyX3Bi`19y0LOOM?+1H-G;5>MR=Ahvm>Zt0Bmc};~^ z(buco8jV`%y#E6&g-=}$Z}`>G9OmH}7(WJQ#Ra|51g9KP{nWnVSU_sL*{Im3t#03y zL#o@*=Hx4?M@CzySL?Uli{0@bZOMNYl-e(u_5D}A;@A~dz5;NKE8oDdedYgO00030 M{}G_sK6jS@0GC=0h5!Hn diff --git a/weed/admin/view/app/policies.templ b/weed/admin/view/app/policies.templ index ac529054f..dd85f75c2 100644 --- a/weed/admin/view/app/policies.templ +++ b/weed/admin/view/app/policies.templ @@ -198,22 +198,7 @@ templ Policies(data dash.PoliciesData) { } - - - for _, action := range PolicyActionSuggestions { - - } - - - - - - - + @PolicyDatalists() ") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } - for _, action := range PolicyActionSuggestions { - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "") - if templ_7745c5c3_Err != nil { - return templ_7745c5c3_Err - } + templ_7745c5c3_Err = PolicyDatalists().Render(ctx, templ_7745c5c3_Buffer) + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "
Create IAM Policy
Enter a unique name for this policy (alphanumeric and underscores only)
Enter the policy document in AWS IAM JSON format
View IAM Policy

Loading policy...

Edit IAM Policy
Policy name cannot be changed
Edit the policy document in AWS IAM JSON format
") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "
Create IAM Policy
Enter a unique name for this policy (alphanumeric and underscores only)
Enter the policy document in AWS IAM JSON format
View IAM Policy

Loading policy...

Edit IAM Policy
Policy name cannot be changed
Edit the policy document in AWS IAM JSON format
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } diff --git a/weed/admin/view/app/policy_datalists.templ b/weed/admin/view/app/policy_datalists.templ new file mode 100644 index 000000000..53a916503 --- /dev/null +++ b/weed/admin/view/app/policy_datalists.templ @@ -0,0 +1,28 @@ +package app + +// PolicyDatalists renders the three elements the shared visual +// policy editor (weed/admin/static/js/policy_editor.js) attaches its +// action/resource/principal suggestions to. Any page +// embedding that editor must render this once; its ids +// (policyActionSuggestions, policyResourceSuggestions, +// policyPrincipalSuggestions) are the registerPolicyEditor defaults, so a +// page only needs to override them if it renders more than one instance of +// this component. +templ PolicyDatalists() { + + + for _, action := range PolicyActionSuggestions { + + } + + + + + + + +} diff --git a/weed/admin/view/app/policy_datalists_templ.go b/weed/admin/view/app/policy_datalists_templ.go new file mode 100644 index 000000000..0116f6845 --- /dev/null +++ b/weed/admin/view/app/policy_datalists_templ.go @@ -0,0 +1,71 @@ +// Code generated by templ - DO NOT EDIT. + +// templ: version: v0.3.1020 +package app + +//lint:file-ignore SA4006 This context is only used if a nested component is present. + +import "github.com/a-h/templ" +import templruntime "github.com/a-h/templ/runtime" + +// PolicyDatalists renders the three elements the shared visual +// policy editor (weed/admin/static/js/policy_editor.js) attaches its +// action/resource/principal suggestions to. Any page +// embedding that editor must render this once; its ids +// (policyActionSuggestions, policyResourceSuggestions, +// policyPrincipalSuggestions) are the registerPolicyEditor defaults, so a +// page only needs to override them if it renders more than one instance of +// this component. +func PolicyDatalists() templ.Component { + return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) { + templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context + if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil { + return templ_7745c5c3_CtxErr + } + templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W) + if !templ_7745c5c3_IsBuffer { + defer func() { + templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer) + if templ_7745c5c3_Err == nil { + templ_7745c5c3_Err = templ_7745c5c3_BufErr + } + }() + } + ctx = templ.InitializeContext(ctx) + templ_7745c5c3_Var1 := templ.GetChildren(ctx) + if templ_7745c5c3_Var1 == nil { + templ_7745c5c3_Var1 = templ.NopComponent + } + ctx = templ.ClearChildren(ctx) + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "") + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + for _, action := range PolicyActionSuggestions { + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "") + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + } + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "") + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + return nil + }) +} + +var _ = templruntime.GeneratedTemplate diff --git a/weed/admin/view/app/s3_buckets.templ b/weed/admin/view/app/s3_buckets.templ index 47714f1bd..fe124cd3a 100644 --- a/weed/admin/view/app/s3_buckets.templ +++ b/weed/admin/view/app/s3_buckets.templ @@ -151,6 +151,7 @@ templ S3Buckets(data dash.S3BucketsData) { Versioning Object Lock Lifecycle + Policy Actions @@ -255,6 +256,21 @@ templ S3Buckets(data dash.S3BucketsData) { Not configured } + + if bucket.PolicyStatementCount > 0 { + + } else { + Not configured + } +
- +
+ @PolicyDatalists() + + + +
Last updated: ") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 97, "
Last updated: ") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } - var templ_7745c5c3_Var38 string - templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05")) + var templ_7745c5c3_Var41 string + templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 386, Col: 81} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/app/s3_buckets.templ`, Line: 408, Col: 81} } - _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38)) + _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var41)) if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "
Create New S3 Bucket
Bucket names must be between 3 and 63 characters, contain only lowercase letters, numbers, dots, and hyphens.
The S3 identity that owns this bucket. Non-admin users can only access buckets they own.
Set the maximum storage size for this bucket.
Keep multiple versions of objects in this bucket.
Prevent objects from being deleted or overwritten for a specified period. Automatically enables versioning.
Governance allows override with special permissions, Compliance is immutable.
Apply default retention to all new objects in this bucket.
Default retention period for new objects (1-36500 days).
Delete Bucket

Are you sure you want to delete the bucket ?

Warning: This action cannot be undone. All objects in the bucket will be permanently deleted.
Manage Bucket Quota
Set the maximum storage size for this bucket. Set to 0 to remove quota.
Bucket Details
Loading bucket details...
Lifecycle
Manage Bucket Owner
Select the S3 identity that owns this bucket. Non-admin users can only access buckets they own.
Loading users...
") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 98, "
Create New S3 Bucket
Bucket names must be between 3 and 63 characters, contain only lowercase letters, numbers, dots, and hyphens.
The S3 identity that owns this bucket. Non-admin users can only access buckets they own.
Set the maximum storage size for this bucket.
Keep multiple versions of objects in this bucket.
Prevent objects from being deleted or overwritten for a specified period. Automatically enables versioning.
Governance allows override with special permissions, Compliance is immutable.
Apply default retention to all new objects in this bucket.
Default retention period for new objects (1-36500 days).
Delete Bucket

Are you sure you want to delete the bucket ?

Warning: This action cannot be undone. All objects in the bucket will be permanently deleted.
Manage Bucket Quota
Set the maximum storage size for this bucket. Set to 0 to remove quota.
Bucket Details
Loading bucket details...
Lifecycle
") + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + templ_7745c5c3_Err = PolicyDatalists().Render(ctx, templ_7745c5c3_Buffer) + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 99, "
Bucket Policy
Loading bucket policy...

Every statement must specify a Principal, and every Resource must refer to this bucket. Leave the document empty and click Delete to remove the policy.

Enter the bucket policy document as JSON
Manage Bucket Owner
Select the S3 identity that owns this bucket. Non-admin users can only access buckets they own.
Loading users...
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } diff --git a/weed/admin/view/app/s3tables_buckets.templ b/weed/admin/view/app/s3tables_buckets.templ index b6458e41d..9530175d0 100644 --- a/weed/admin/view/app/s3tables_buckets.templ +++ b/weed/admin/view/app/s3tables_buckets.templ @@ -150,6 +150,7 @@ templ S3TablesBuckets(data dash.S3TablesBucketsData) { ARN Catalog Endpoint Created + Policy Actions @@ -164,6 +165,20 @@ templ S3TablesBuckets(data dash.S3TablesBucketsData) { { bucket.ARN } { bucketCatalogPath(bucket.Format, bucket.Name) } { bucket.CreatedAt.Format("2006-01-02 15:04") } + + if bucket.PolicyStatementCount > 0 { + + } else { + Not configured + } +
{{ bucketName, parseErr := s3tables.ParseBucketNameFromARN(bucket.ARN) }} @@ -191,7 +206,7 @@ templ S3TablesBuckets(data dash.S3TablesBucketsData) { } if len(data.Buckets) == 0 { - +
No table buckets found
@@ -395,8 +410,10 @@ dataset = lance.dataset(table.location, storage_options=table.storage_options)`
+ @PolicyDatalists() + ") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } if data.IcebergPort > 0 || data.LancePort > 0 { - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "
Client Examples
") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "
Client Examples
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } if data.IcebergPort > 0 { - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "
ICEBERGDuckDB
")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "
ICEBERGDuckDB
")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var27 string
-				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(`INSTALL iceberg;
+				var templ_7745c5c3_Var29 string
+				templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(`INSTALL iceberg;
 LOAD iceberg;
 
 CREATE SECRET (
@@ -471,18 +519,18 @@ CREATE SECRET (
 
 SELECT * FROM iceberg_scan('s3://my-table-bucket/my-namespace/my-table');`)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 236, Col: 74}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/app/s3tables_buckets.templ`, Line: 251, Col: 74}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "
ICEBERGPython (PyIceberg)
")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "
ICEBERGPython (PyIceberg)
")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var28 string
-				templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(`from pyiceberg.catalog import load_catalog
+				var templ_7745c5c3_Var30 string
+				templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(`from pyiceberg.catalog import load_catalog
 
 catalog = load_catalog(
     name="seaweedfs",
@@ -495,60 +543,60 @@ catalog = load_catalog(
 
 namespaces = catalog.list_namespaces()`)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 253, Col: 39}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/app/s3tables_buckets.templ`, Line: 268, Col: 39}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "
")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } } if data.LancePort > 0 { - var templ_7745c5c3_Var29 = []any{templ.KV("mt-4", data.IcebergPort > 0)} - templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var29...) + var templ_7745c5c3_Var31 = []any{templ.KV("mt-4", data.IcebergPort > 0)} + templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var31...) if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "
LANCEPython (lance-namespace)
")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "\">LANCEPython (lance-namespace)
")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var31 string
-				templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(`from lance_namespace import connect
+				var templ_7745c5c3_Var33 string
+				templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(`from lance_namespace import connect
 
 ns = connect("rest", {"uri": "http://localhost:` + fmt.Sprintf("%d", data.LancePort) + `"})
 
 ns.list_namespaces(id=["my-table-bucket"])
 ns.describe_table(id=["my-table-bucket", "my-namespace", "my-table"])`)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 266, Col: 70}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/app/s3tables_buckets.templ`, Line: 281, Col: 70}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "
LANCEPython (pylance)
")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "
LANCEPython (pylance)
")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var32 string
-				templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinStringErrs(`import lance
+				var templ_7745c5c3_Var34 string
+				templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(`import lance
 from lance_namespace import connect
 
 ns = connect("rest", {"uri": "http://localhost:` + fmt.Sprintf("%d", data.LancePort) + `"})
@@ -557,84 +605,92 @@ table = ns.describe_table(id=["my-table-bucket", "my-namespace", "my-table"])
 # The namespace vends both the location and the credentials to read it.
 dataset = lance.dataset(table.location, storage_options=table.storage_options)`)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 279, Col: 79}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/app/s3tables_buckets.templ`, Line: 294, Col: 79}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "
")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "
") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, "
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "
Create Table Bucket
") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "
Create Table Bucket
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } if data.IcebergPort > 0 { - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, " ") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, " ") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } } else { - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, " ") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, " ") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "
") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } if data.LancePort > 0 && data.IcebergPort <= 0 { - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, " ") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, " ") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } } else if data.LancePort > 0 { - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, " ") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, " ") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } } else { - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, " ") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, " ") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, "
Lance Served over the Lance Namespace API. pylance, LanceDB, Ray.
A bucket holds one format. Tables of the other are refused.
The S3 identity that owns this table bucket. Non-admin users can only access table buckets they own.
Optional tags in key=value format.
Delete Table Bucket

Are you sure you want to delete the table bucket ?

Table Bucket Policy
Provide a policy JSON; use Delete Policy to remove the policy.
Resource Tags
Loading...
") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "\">A bucket holds one format. Tables of the other are refused.
The S3 identity that owns this table bucket. Non-admin users can only access table buckets they own.
Optional tags in key=value format.
Delete Table Bucket

Are you sure you want to delete the table bucket ?

") + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + templ_7745c5c3_Err = PolicyDatalists().Render(ctx, templ_7745c5c3_Buffer) + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "
Table Bucket Policy
Provide a policy JSON; use Delete Policy to remove the policy.
Resource Tags
Loading...
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } diff --git a/weed/admin/view/app/s3tables_tables.templ b/weed/admin/view/app/s3tables_tables.templ index 84ce15481..8df58785d 100644 --- a/weed/admin/view/app/s3tables_tables.templ +++ b/weed/admin/view/app/s3tables_tables.templ @@ -254,8 +254,10 @@ templ S3TablesTables(data dash.S3TablesTablesData) { + @PolicyDatalists() +
Delete Table

Are you sure you want to delete the table ?

") + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + templ_7745c5c3_Err = PolicyDatalists().Render(ctx, templ_7745c5c3_Buffer) + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "
Table Policy
Resource Tags
Loading...
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } diff --git a/weed/admin/view/layout/layout.templ b/weed/admin/view/layout/layout.templ index 9733919de..09fc8f0cf 100644 --- a/weed/admin/view/layout/layout.templ +++ b/weed/admin/view/layout/layout.templ @@ -370,6 +370,7 @@ templ Layout(view ViewContext, content templ.Component) { + } diff --git a/weed/admin/view/layout/layout_templ.go b/weed/admin/view/layout/layout_templ.go index 5c7fa667f..bd1ad4cf8 100644 --- a/weed/admin/view/layout/layout_templ.go +++ b/weed/admin/view/layout/layout_templ.go @@ -85,7 +85,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var2 string templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.ResolveAttributeValue(csrfToken) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 55, Col: 47} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 55, Col: 47} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var2) if templ_7745c5c3_Err != nil { @@ -98,7 +98,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var3 templ.SafeURL templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinURLErrs(string(view.P("/static/favicon.ico"))) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 56, Col: 65} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 56, Col: 65} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3)) if templ_7745c5c3_Err != nil { @@ -111,7 +111,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var4 templ.SafeURL templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinURLErrs(string(view.P("/static/css/bootstrap.min.css"))) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 59, Col: 64} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 59, Col: 64} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4)) if templ_7745c5c3_Err != nil { @@ -124,7 +124,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var5 templ.SafeURL templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinURLErrs(string(view.P("/static/css/fontawesome.min.css"))) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 61, Col: 66} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 61, Col: 66} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5)) if templ_7745c5c3_Err != nil { @@ -137,7 +137,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var6 string templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/htmx.min.js"))) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 63, Col: 58} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 63, Col: 58} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var6) if templ_7745c5c3_Err != nil { @@ -150,7 +150,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var7 templ.SafeURL templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinURLErrs(string(view.P("/static/css/admin.css"))) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 65, Col: 73} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 65, Col: 73} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7)) if templ_7745c5c3_Err != nil { @@ -171,7 +171,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var8 templ.SafeURL templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/admin")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 74, Col: 71} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 74, Col: 71} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8)) if templ_7745c5c3_Err != nil { @@ -184,7 +184,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var9 string templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(username) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 90, Col: 73} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 90, Col: 73} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9)) if templ_7745c5c3_Err != nil { @@ -197,7 +197,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var10 templ.SafeURL templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/logout")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 93, Col: 85} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 93, Col: 85} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10)) if templ_7745c5c3_Err != nil { @@ -210,7 +210,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var11 templ.SafeURL templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/admin")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 112, Col: 71} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 112, Col: 71} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11)) if templ_7745c5c3_Err != nil { @@ -232,7 +232,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var13 string templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var12).String()) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 1, Col: 0} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 1, Col: 0} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var13) if templ_7745c5c3_Err != nil { @@ -245,7 +245,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var14 string templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%t", isClusterPage)) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 117, Col: 207} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 117, Col: 207} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14) if templ_7745c5c3_Err != nil { @@ -267,7 +267,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var16 string templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var15).String()) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 1, Col: 0} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 1, Col: 0} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16) if templ_7745c5c3_Err != nil { @@ -280,7 +280,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var17 templ.SafeURL templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/cluster/masters")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 124, Col: 98} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 124, Col: 98} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17)) if templ_7745c5c3_Err != nil { @@ -293,7 +293,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var18 templ.SafeURL templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/cluster/volume-servers")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 129, Col: 105} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 129, Col: 105} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18)) if templ_7745c5c3_Err != nil { @@ -306,7 +306,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var19 templ.SafeURL templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/cluster/filers")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 134, Col: 97} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 134, Col: 97} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19)) if templ_7745c5c3_Err != nil { @@ -319,7 +319,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var20 templ.SafeURL templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/cluster/s3")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 139, Col: 93} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 139, Col: 93} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20)) if templ_7745c5c3_Err != nil { @@ -332,7 +332,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var21 templ.SafeURL templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/cluster/mount-clients")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 144, Col: 104} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 144, Col: 104} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21)) if templ_7745c5c3_Err != nil { @@ -354,7 +354,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var23 string templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var22).String()) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 1, Col: 0} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 1, Col: 0} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var23) if templ_7745c5c3_Err != nil { @@ -367,7 +367,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var24 string templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%t", isStoragePage)) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 152, Col: 207} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 152, Col: 207} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var24) if templ_7745c5c3_Err != nil { @@ -389,7 +389,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var26 string templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var25).String()) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 1, Col: 0} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 1, Col: 0} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var26) if templ_7745c5c3_Err != nil { @@ -402,7 +402,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var27 templ.SafeURL templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/storage/volumes")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 159, Col: 98} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 159, Col: 98} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27)) if templ_7745c5c3_Err != nil { @@ -415,7 +415,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var28 templ.SafeURL templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/storage/ec-shards")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 164, Col: 100} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 164, Col: 100} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28)) if templ_7745c5c3_Err != nil { @@ -428,7 +428,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var29 templ.SafeURL templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/storage/collections")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 169, Col: 102} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 169, Col: 102} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29)) if templ_7745c5c3_Err != nil { @@ -441,7 +441,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var30 templ.SafeURL templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/object-store/buckets")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 183, Col: 86} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 183, Col: 86} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30)) if templ_7745c5c3_Err != nil { @@ -454,7 +454,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var31 templ.SafeURL templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/object-store/s3tables/buckets")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 188, Col: 95} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 188, Col: 95} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31)) if templ_7745c5c3_Err != nil { @@ -467,7 +467,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var32 templ.SafeURL templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/object-store/users")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 193, Col: 84} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 193, Col: 84} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32)) if templ_7745c5c3_Err != nil { @@ -480,7 +480,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var33 templ.SafeURL templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/object-store/groups")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 198, Col: 85} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 198, Col: 85} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33)) if templ_7745c5c3_Err != nil { @@ -493,7 +493,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var34 templ.SafeURL templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/object-store/service-accounts")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 203, Col: 95} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 203, Col: 95} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34)) if templ_7745c5c3_Err != nil { @@ -506,7 +506,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var35 templ.SafeURL templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/object-store/policies")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 208, Col: 87} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 208, Col: 87} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var35)) if templ_7745c5c3_Err != nil { @@ -519,7 +519,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var36 templ.SafeURL templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/files")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 219, Col: 71} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 219, Col: 71} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36)) if templ_7745c5c3_Err != nil { @@ -553,7 +553,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var37 templ.SafeURL templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/mq/brokers")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 240, Col: 108} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 240, Col: 108} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37)) if templ_7745c5c3_Err != nil { @@ -571,7 +571,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var38 templ.SafeURL templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/mq/brokers")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 244, Col: 101} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 244, Col: 101} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38)) if templ_7745c5c3_Err != nil { @@ -594,7 +594,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var39 templ.SafeURL templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/mq/topics")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 251, Col: 107} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 251, Col: 107} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39)) if templ_7745c5c3_Err != nil { @@ -612,7 +612,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var40 templ.SafeURL templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/mq/topics")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 255, Col: 100} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 255, Col: 100} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var40)) if templ_7745c5c3_Err != nil { @@ -635,7 +635,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var41 templ.SafeURL templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/mq/brokers")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 267, Col: 97} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 267, Col: 97} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var41)) if templ_7745c5c3_Err != nil { @@ -648,7 +648,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var42 templ.SafeURL templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/mq/topics")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 272, Col: 96} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 272, Col: 96} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var42)) if templ_7745c5c3_Err != nil { @@ -671,7 +671,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var43 templ.SafeURL templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/default")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 289, Col: 97} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 289, Col: 97} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var43)) if templ_7745c5c3_Err != nil { @@ -689,7 +689,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var44 templ.SafeURL templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/default")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 293, Col: 90} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 293, Col: 90} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var44)) if templ_7745c5c3_Err != nil { @@ -712,7 +712,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var45 templ.SafeURL templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/lifecycle")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 300, Col: 99} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 300, Col: 99} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var45)) if templ_7745c5c3_Err != nil { @@ -730,7 +730,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var46 templ.SafeURL templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/lifecycle")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 304, Col: 92} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 304, Col: 92} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var46)) if templ_7745c5c3_Err != nil { @@ -753,7 +753,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var47 templ.SafeURL templ_7745c5c3_Var47, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/iceberg")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 311, Col: 97} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 311, Col: 97} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var47)) if templ_7745c5c3_Err != nil { @@ -771,7 +771,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var48 templ.SafeURL templ_7745c5c3_Var48, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/iceberg")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 315, Col: 90} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 315, Col: 90} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var48)) if templ_7745c5c3_Err != nil { @@ -794,7 +794,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var49 templ.SafeURL templ_7745c5c3_Var49, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/lance")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 322, Col: 95} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 322, Col: 95} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var49)) if templ_7745c5c3_Err != nil { @@ -812,7 +812,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var50 templ.SafeURL templ_7745c5c3_Var50, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/lance")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 326, Col: 88} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 326, Col: 88} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var50)) if templ_7745c5c3_Err != nil { @@ -838,7 +838,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var51 string templ_7745c5c3_Var51, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", time.Now().Year())) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 351, Col: 60} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 351, Col: 60} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var51)) if templ_7745c5c3_Err != nil { @@ -851,7 +851,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var52 string templ_7745c5c3_Var52, templ_7745c5c3_Err = templ.JoinStringErrs(version.VERSION_NUMBER) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 351, Col: 102} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 351, Col: 102} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var52)) if templ_7745c5c3_Err != nil { @@ -869,7 +869,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var53 string templ_7745c5c3_Var53, templ_7745c5c3_Err = templ.JoinStringErrs(version.COMMIT) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 353, Col: 55} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 353, Col: 55} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var53)) if templ_7745c5c3_Err != nil { @@ -893,7 +893,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var54 string templ_7745c5c3_Var54, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/bootstrap.bundle.min.js"))) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 366, Col: 70} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 366, Col: 70} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var54) if templ_7745c5c3_Err != nil { @@ -906,7 +906,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var55 string templ_7745c5c3_Var55, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/modal-alerts.js"))) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 368, Col: 62} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 368, Col: 62} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var55) if templ_7745c5c3_Err != nil { @@ -919,7 +919,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var56 string templ_7745c5c3_Var56, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/admin.js"))) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 370, Col: 55} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 370, Col: 55} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var56) if templ_7745c5c3_Err != nil { @@ -932,7 +932,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var57 string templ_7745c5c3_Var57, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/iam-utils.js"))) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 371, Col: 59} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 371, Col: 59} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var57) if templ_7745c5c3_Err != nil { @@ -945,13 +945,26 @@ func Layout(view ViewContext, content templ.Component) templ.Component { var templ_7745c5c3_Var58 string templ_7745c5c3_Var58, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/s3tables.js"))) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 372, Col: 58} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 372, Col: 58} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var58) if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "\">") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "\">") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } @@ -975,140 +988,140 @@ func LoginForm(title string, errorMessage string, csrfToken string) templ.Compon }() } ctx = templ.InitializeContext(ctx) - templ_7745c5c3_Var59 := templ.GetChildren(ctx) - if templ_7745c5c3_Var59 == nil { - templ_7745c5c3_Var59 = templ.NopComponent + templ_7745c5c3_Var60 := templ.GetChildren(ctx) + if templ_7745c5c3_Var60 == nil { + templ_7745c5c3_Var60 = templ.NopComponent } ctx = templ.ClearChildren(ctx) prefix := dash.URLPrefixFromContext(ctx) - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, "<!doctype html><html lang=\"en\"><head><meta charset=\"UTF-8\"><title>") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } - var templ_7745c5c3_Var60 string - templ_7745c5c3_Var60, templ_7745c5c3_Err = templ.JoinStringErrs(title) + var templ_7745c5c3_Var61 string + templ_7745c5c3_Var61, templ_7745c5c3_Err = templ.JoinStringErrs(title) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 385, Col: 17} - } - _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var60)) - if templ_7745c5c3_Err != nil { - return templ_7745c5c3_Err - } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, " - Login

") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "\" rel=\"stylesheet\">

Please sign in to continue

") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, "\" rel=\"stylesheet\">

") + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + var templ_7745c5c3_Var65 string + templ_7745c5c3_Var65, templ_7745c5c3_Err = templ.JoinStringErrs(title) + if templ_7745c5c3_Err != nil { + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 400, Col: 57} + } + _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var65)) + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 93, "

Please sign in to continue

") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } if errorMessage != "" { - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 93, "
") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 94, "
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } - var templ_7745c5c3_Var65 string - templ_7745c5c3_Var65, templ_7745c5c3_Err = templ.JoinStringErrs(errorMessage) + var templ_7745c5c3_Var66 string + templ_7745c5c3_Var66, templ_7745c5c3_Err = templ.JoinStringErrs(errorMessage) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 406, Col: 45} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `weed/admin/view/layout/layout.templ`, Line: 407, Col: 45} } - _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var65)) + _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var66)) if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 94, "
") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 95, "
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 95, "
") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 98, "\">
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } diff --git a/weed/s3api/policy_engine/bucket_policy.go b/weed/s3api/policy_engine/bucket_policy.go new file mode 100644 index 000000000..b7cf969c9 --- /dev/null +++ b/weed/s3api/policy_engine/bucket_policy.go @@ -0,0 +1,86 @@ +package policy_engine + +import ( + "fmt" + "strings" +) + +// ValidateBucketPolicy performs bucket-specific policy validation, on top of +// the generic structural checks in ValidatePolicy. It enforces the rules +// that make a policy document valid as an S3 *bucket* policy specifically: +// every statement must name a Principal, and every Resource/NotResource/Action +// must scope to the given bucket. +// +// This is shared between the S3 gateway's PutBucketPolicy handler +// (weed/s3api/s3api_bucket_policy_handlers.go) and the admin UI +// (weed/admin/dash) so both enforce identical rules. +func ValidateBucketPolicy(policyDoc *PolicyDocument, bucket string) error { + if policyDoc.Version != PolicyVersion2012_10_17 { + return fmt.Errorf("unsupported policy version: %s (must be %s)", policyDoc.Version, PolicyVersion2012_10_17) + } + + if len(policyDoc.Statement) == 0 { + return fmt.Errorf("policy document must contain at least one statement") + } + + for i, statement := range policyDoc.Statement { + // Bucket policies must have Principal + if statement.Principal == nil { + return fmt.Errorf("statement %d: bucket policies must specify a Principal", i) + } + + // Validate resources refer to this bucket + for _, resource := range statement.Resource.Strings() { + if !ResourceMatchesBucket(resource, bucket) { + return fmt.Errorf("statement %d: resource %s does not match bucket %s", i, resource, bucket) + } + } + + // Validate NotResources refer to this bucket + if statement.NotResource != nil { + for _, notResource := range statement.NotResource.Strings() { + if !ResourceMatchesBucket(notResource, bucket) { + return fmt.Errorf("statement %d: NotResource %s does not match bucket %s", i, notResource, bucket) + } + } + } + + // Validate actions are S3 actions + for _, action := range statement.Action.Strings() { + if !strings.HasPrefix(action, "s3:") { + return fmt.Errorf("statement %d: bucket policies only support S3 actions, got %s", i, action) + } + } + } + + return nil +} + +// ResourceMatchesBucket checks if a resource ARN is valid for the given bucket. +func ResourceMatchesBucket(resource, bucket string) bool { + // Accepted formats for S3 bucket policies: + // AWS-style ARNs (standard): + // arn:aws:s3:::bucket-name + // arn:aws:s3:::bucket-name/* + // arn:aws:s3:::bucket-name/path/to/object + // Simplified formats (for convenience): + // bucket-name + // bucket-name/* + // bucket-name/path/to/object + + var resourcePath string + const awsPrefix = "arn:aws:s3:::" + + // Strip the optional ARN prefix to get the resource path + if path, ok := strings.CutPrefix(resource, awsPrefix); ok { + resourcePath = path + } else { + resourcePath = resource + } + + // After stripping the optional ARN prefix, the resource path must + // either match the bucket name exactly, or be a path within the bucket. + return resourcePath == bucket || + resourcePath == bucket+"/*" || + strings.HasPrefix(resourcePath, bucket+"/") +} diff --git a/weed/s3api/policy_engine/bucket_policy_test.go b/weed/s3api/policy_engine/bucket_policy_test.go new file mode 100644 index 000000000..217e1c8fa --- /dev/null +++ b/weed/s3api/policy_engine/bucket_policy_test.go @@ -0,0 +1,106 @@ +package policy_engine + +import "testing" + +func TestResourceMatchesBucket(t *testing.T) { + tests := []struct { + name string + resource string + bucket string + want bool + }{ + {"bare bucket name", "my-bucket", "my-bucket", true}, + {"bare wildcard", "my-bucket/*", "my-bucket", true}, + {"bare object key", "my-bucket/path/to/key", "my-bucket", true}, + {"arn bucket", "arn:aws:s3:::my-bucket", "my-bucket", true}, + {"arn wildcard", "arn:aws:s3:::my-bucket/*", "my-bucket", true}, + {"arn object key", "arn:aws:s3:::my-bucket/path/to/key", "my-bucket", true}, + {"wrong bucket", "other-bucket", "my-bucket", false}, + {"wrong bucket arn", "arn:aws:s3:::other-bucket/*", "my-bucket", false}, + {"prefix collision", "my-bucket2", "my-bucket", false}, + {"prefix collision arn", "arn:aws:s3:::my-bucket2/*", "my-bucket", false}, + {"empty resource", "", "my-bucket", false}, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + if got := ResourceMatchesBucket(tt.resource, tt.bucket); got != tt.want { + t.Errorf("ResourceMatchesBucket(%q, %q) = %v, want %v", tt.resource, tt.bucket, got, tt.want) + } + }) + } +} + +func simpleAwsPrincipal() *PolicyPrincipal { + return NewPolicyPrincipalPtr("*") +} + +func TestValidateBucketPolicy(t *testing.T) { + bucket := "my-bucket" + + validStatement := func() PolicyStatement { + return PolicyStatement{ + Effect: PolicyEffectAllow, + Principal: simpleAwsPrincipal(), + Action: NewStringOrStringSlice("s3:GetObject"), + Resource: NewStringOrStringSlicePtr("arn:aws:s3:::" + bucket + "/*"), + } + } + + t.Run("valid policy", func(t *testing.T) { + doc := &PolicyDocument{Version: PolicyVersion2012_10_17, Statement: []PolicyStatement{validStatement()}} + if err := ValidateBucketPolicy(doc, bucket); err != nil { + t.Errorf("expected no error, got %v", err) + } + }) + + t.Run("bad version", func(t *testing.T) { + doc := &PolicyDocument{Version: "2008-10-17", Statement: []PolicyStatement{validStatement()}} + if err := ValidateBucketPolicy(doc, bucket); err == nil { + t.Error("expected error for bad version") + } + }) + + t.Run("zero statements", func(t *testing.T) { + doc := &PolicyDocument{Version: PolicyVersion2012_10_17, Statement: []PolicyStatement{}} + if err := ValidateBucketPolicy(doc, bucket); err == nil { + t.Error("expected error for zero statements") + } + }) + + t.Run("missing principal", func(t *testing.T) { + stmt := validStatement() + stmt.Principal = nil + doc := &PolicyDocument{Version: PolicyVersion2012_10_17, Statement: []PolicyStatement{stmt}} + if err := ValidateBucketPolicy(doc, bucket); err == nil { + t.Error("expected error for missing principal") + } + }) + + t.Run("foreign resource", func(t *testing.T) { + stmt := validStatement() + stmt.Resource = NewStringOrStringSlicePtr("arn:aws:s3:::other-bucket/*") + doc := &PolicyDocument{Version: PolicyVersion2012_10_17, Statement: []PolicyStatement{stmt}} + if err := ValidateBucketPolicy(doc, bucket); err == nil { + t.Error("expected error for foreign resource") + } + }) + + t.Run("foreign not-resource", func(t *testing.T) { + stmt := validStatement() + stmt.Resource = nil + stmt.NotResource = NewStringOrStringSlicePtr("arn:aws:s3:::other-bucket/*") + doc := &PolicyDocument{Version: PolicyVersion2012_10_17, Statement: []PolicyStatement{stmt}} + if err := ValidateBucketPolicy(doc, bucket); err == nil { + t.Error("expected error for foreign NotResource") + } + }) + + t.Run("non-s3 action", func(t *testing.T) { + stmt := validStatement() + stmt.Action = NewStringOrStringSlice("iam:CreateUser") + doc := &PolicyDocument{Version: PolicyVersion2012_10_17, Statement: []PolicyStatement{stmt}} + if err := ValidateBucketPolicy(doc, bucket); err == nil { + t.Error("expected error for non-s3 action") + } + }) +} diff --git a/weed/s3api/s3api_bucket_policy_handlers.go b/weed/s3api/s3api_bucket_policy_handlers.go index f8cdea153..9e38fe09f 100644 --- a/weed/s3api/s3api_bucket_policy_handlers.go +++ b/weed/s3api/s3api_bucket_policy_handlers.go @@ -7,7 +7,6 @@ import ( "fmt" "io" "net/http" - "strings" "github.com/seaweedfs/seaweedfs/weed/glog" "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb" @@ -16,7 +15,10 @@ import ( "github.com/seaweedfs/seaweedfs/weed/s3api/s3err" ) -// Bucket policy metadata key for storing policies in filer +// Bucket policy metadata key for storing policies in filer. +// Also consumed directly by weed/admin/dash for the admin UI's bucket +// policy management, so keep it exported and don't change its value +// without updating that package too. const BUCKET_POLICY_METADATA_KEY = "s3-bucket-policy" // Sentinel errors for bucket policy operations @@ -97,7 +99,7 @@ func (s3a *S3ApiServer) PutBucketPolicyHandler(w http.ResponseWriter, r *http.Re } // Additional bucket policy specific validation - if err := s3a.validateBucketPolicy(&policyDoc, bucket); err != nil { + if err := policy_engine.ValidateBucketPolicy(&policyDoc, bucket); err != nil { glog.Errorf("Bucket policy validation failed: %v", err) s3err.WriteErrorResponse(w, r, s3err.ErrInvalidPolicyDocument) return @@ -293,78 +295,6 @@ func (s3a *S3ApiServer) deleteBucketPolicy(bucket string) error { }) } -// validateBucketPolicy performs bucket-specific policy validation -func (s3a *S3ApiServer) validateBucketPolicy(policyDoc *policy_engine.PolicyDocument, bucket string) error { - if policyDoc.Version != "2012-10-17" { - return fmt.Errorf("unsupported policy version: %s (must be 2012-10-17)", policyDoc.Version) - } - - if len(policyDoc.Statement) == 0 { - return fmt.Errorf("policy document must contain at least one statement") - } - - for i, statement := range policyDoc.Statement { - // Bucket policies must have Principal - if statement.Principal == nil { - return fmt.Errorf("statement %d: bucket policies must specify a Principal", i) - } - - // Validate resources refer to this bucket - for _, resource := range statement.Resource.Strings() { - if !s3a.validateResourceForBucket(resource, bucket) { - return fmt.Errorf("statement %d: resource %s does not match bucket %s", i, resource, bucket) - } - } - - // Validate NotResources refer to this bucket - if statement.NotResource != nil { - for _, notResource := range statement.NotResource.Strings() { - if !s3a.validateResourceForBucket(notResource, bucket) { - return fmt.Errorf("statement %d: NotResource %s does not match bucket %s", i, notResource, bucket) - } - } - } - - // Validate actions are S3 actions - for _, action := range statement.Action.Strings() { - if !strings.HasPrefix(action, "s3:") { - return fmt.Errorf("statement %d: bucket policies only support S3 actions, got %s", i, action) - } - } - } - - return nil -} - -// validateResourceForBucket checks if a resource ARN is valid for the given bucket -func (s3a *S3ApiServer) validateResourceForBucket(resource, bucket string) bool { - // Accepted formats for S3 bucket policies: - // AWS-style ARNs (standard): - // arn:aws:s3:::bucket-name - // arn:aws:s3:::bucket-name/* - // arn:aws:s3:::bucket-name/path/to/object - // Simplified formats (for convenience): - // bucket-name - // bucket-name/* - // bucket-name/path/to/object - - var resourcePath string - const awsPrefix = "arn:aws:s3:::" - - // Strip the optional ARN prefix to get the resource path - if path, ok := strings.CutPrefix(resource, awsPrefix); ok { - resourcePath = path - } else { - resourcePath = resource - } - - // After stripping the optional ARN prefix, the resource path must - // either match the bucket name exactly, or be a path within the bucket. - return resourcePath == bucket || - resourcePath == bucket+"/*" || - strings.HasPrefix(resourcePath, bucket+"/") -} - // IAM integration functions // updateBucketPolicyInIAM updates the IAM system with the new bucket policy