Update plugin_templ.go

Move "Next Run" from a standalone card into the top row alongside
Workers, Active Jobs, and Activities as a compact stat card.

.github/workflows/container_dev.yml

@@ -32,7 +32,7 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v1
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v1
       -
         name: Create BuildKit config
         run: |
@@ -42,28 +42,28 @@ jobs:
           EOF
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v1
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v1
         with:
           buildkitd-flags: "--debug"
           buildkitd-config: /tmp/buildkitd.toml
       -
         name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       -
         name: Login to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v1
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
           password: ${{ secrets.GHCR_TOKEN }}
       -
         name: Build
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v2
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v2
         with:
           context: ./docker
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/container_foundationdb_version.yml

@@ -126,14 +126,14 @@ jobs:
           echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -150,7 +150,7 @@ jobs:
           fi
 
       - name: Build and push image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: ./docker
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/container_latest.yml

@@ -98,7 +98,7 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
       - name: Set up QEMU
         if: matrix.platform != 'amd64'
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
       - name: Create BuildKit config
         run: |
           cat > /tmp/buildkitd.toml <<EOF
@@ -106,25 +106,25 @@ jobs:
             mirrors = ["https://mirror.gcr.io"]
           EOF
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
         with:
           buildkitd-flags: "--debug"
           buildkitd-config: /tmp/buildkitd.toml
       - name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Login to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
           password: ${{ secrets.GHCR_TOKEN }}
       - name: Build ${{ matrix.platform }} ${{ matrix.variant }}
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         env:
           DOCKER_BUILDKIT: 1
         with:
@@ -180,12 +180,12 @@ jobs:
             ghcr.io/chrislusf/seaweedfs
           tags: type=raw,value=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }},suffix=${{ steps.config.outputs.tag_suffix }}
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Login to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}

.github/workflows/container_release_foundationdb.yml

@@ -35,14 +35,14 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
       -
         name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -57,7 +57,7 @@ jobs:
           fi
       -
         name: Build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: ./docker
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/container_release_unified.yml

@@ -117,7 +117,7 @@ jobs:
             
       - name: Set up QEMU
         if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && contains(matrix.platforms, 'arm')
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
         
       - name: Create BuildKit config
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
@@ -129,20 +129,20 @@ jobs:
           
       - name: Set up Docker Buildx
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
         with:
           buildkitd-config: /tmp/buildkitd.toml
           
       - name: Login to Docker Hub
         if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           
       - name: Login to GHCR
         if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
@@ -150,7 +150,7 @@ jobs:
           
       - name: Build and push ${{ matrix.variant }}
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         env:
           DOCKER_BUILDKIT: 1
         with:
@@ -198,14 +198,14 @@ jobs:
     steps:
       - name: Login to Docker Hub
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           
       - name: Login to GHCR
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}

.github/workflows/container_rocksdb_version.yml

@@ -82,19 +82,19 @@ jobs:
           echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v1
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v1
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v1
 
       - name: Login to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Build and push image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v2
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v2
         with:
           context: ./docker
           push: true

.github/workflows/deploy_telemetry.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version-file: 'go.mod'
+          go-version: '1.24'
 
       - name: Build Telemetry Server
         if: github.event_name == 'workflow_dispatch' && inputs.deploy

.github/workflows/depsreview.yml

@@ -11,4 +11,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48
+        uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803

.github/workflows/e2e.yml

@@ -23,16 +23,17 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-
-    - name: Set up Go
-      uses: actions/setup-go@v6
+    - name: Set up Go 1.x
+      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
       with:
-        go-version-file: 'go.mod'
+        go-version: ^1.13
+      id: go
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@v3
       
     - name: Cache Docker layers
       uses: actions/cache@v5

.github/workflows/ec-integration-tests.yml

@@ -18,7 +18,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
       id: go
 
     - name: Check out code into the Go module directory

.github/workflows/ec-integration.yml

@@ -28,7 +28,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v6
       with:
-        go-version-file: 'go.mod'
+        go-version: '1.24'
         
     - name: Build weed binary
       run: |

.github/workflows/fuse-integration.yml

@@ -22,6 +22,7 @@ permissions:
   contents: read
 
 env:
+  GO_VERSION: '1.24'
   TEST_TIMEOUT: '45m'
 
 jobs:
@@ -34,10 +35,10 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v6
       
-    - name: Set up Go
+    - name: Set up Go ${{ env.GO_VERSION }}
       uses: actions/setup-go@v6
       with:
-        go-version-file: 'go.mod'
+        go-version: ${{ env.GO_VERSION }}
         
     - name: Install FUSE and dependencies
       run: |

.github/workflows/go.yml

@@ -19,12 +19,13 @@ jobs:
     name: Go Vet
     runs-on: ubuntu-latest
     steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-    - name: Set up Go
-      uses: actions/setup-go@v6
+    - name: Set up Go 1.x
+      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
       with:
-        go-version-file: 'go.mod'
+        go-version: ^1.13
+      id: go
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
     - name: Get dependencies
       run: |
         cd weed; go get -v -t -d ./...
@@ -41,12 +42,13 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-    - name: Set up Go
-      uses: actions/setup-go@v6
+    - name: Set up Go 1.x
+      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
       with:
-        go-version-file: 'go.mod'
+        go-version: ^1.13
+      id: go
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
     - name: Build
       run: cd weed; go build -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v .
 
@@ -54,11 +56,12 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-    - name: Set up Go
-      uses: actions/setup-go@v6
+    - name: Set up Go 1.x
+      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
       with:
-        go-version-file: 'go.mod'
+        go-version: ^1.13
+      id: go
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
     - name: Test
       run: cd weed; go test -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v ./...

.github/workflows/kafka-quicktest.yml

@@ -26,14 +26,14 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
         cache: true
         cache-dependency-path: |
           **/go.sum
       id: go
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@v3
 
     - name: Install dependencies
       run: |

.github/workflows/kafka-tests.yml

@@ -37,7 +37,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
       id: go
 
     - name: Check out code
@@ -82,7 +82,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
       id: go
 
     - name: Check out code
@@ -132,7 +132,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -311,7 +311,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -473,7 +473,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -631,7 +631,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -789,7 +789,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
       id: go
 
     - name: Check out code

.github/workflows/metadata-subscribe-tests.yml

@@ -30,6 +30,7 @@ permissions:
   contents: read
 
 env:
+  GO_VERSION: '1.24'
   TEST_TIMEOUT: '10m'
 
 jobs:
@@ -42,10 +43,10 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v6
       
-    - name: Set up Go
+    - name: Set up Go ${{ env.GO_VERSION }}
       uses: actions/setup-go@v6
       with:
-        go-version-file: 'go.mod'
+        go-version: ${{ env.GO_VERSION }}
         
     - name: Build SeaweedFS
       run: |

.github/workflows/postgres-tests.yml

@@ -25,14 +25,14 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.25
+        go-version: ^1.24
       id: go
 
     - name: Check out code
       uses: actions/checkout@v6
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@v3
 
     - name: Cache Docker layers
       uses: actions/cache@v5

.github/workflows/s3-iam-tests.yml

@@ -5,8 +5,6 @@ on:
     paths:
       - 'weed/iam/**'
       - 'weed/s3api/**'
-      - 'weed/credential/**'
-      - 'weed/pb/**'
       - 'test/s3/iam/**'
       - '.github/workflows/s3-iam-tests.yml'
   push:
@@ -14,8 +12,6 @@ on:
     paths:
       - 'weed/iam/**'
       - 'weed/s3api/**'
-      - 'weed/credential/**'
-      - 'weed/pb/**'
       - 'test/s3/iam/**'
       - '.github/workflows/s3-iam-tests.yml'
   
@@ -84,7 +80,7 @@ jobs:
     timeout-minutes: 25
     strategy:
       matrix:
-        test-type: ["basic", "advanced", "policy-enforcement", "group"]
+        test-type: ["basic", "advanced", "policy-enforcement"]
         
     steps:
       - name: Check out code
@@ -121,7 +117,7 @@ jobs:
             "basic")
               echo "Running basic IAM functionality tests..."
               make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation|TestIAMUserManagement|TestIAMAccessKeyManagement|TestIAMPolicyManagement" ./...
+              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation|TestIAM" ./...
               ;;
             "advanced")
               echo "Running advanced IAM feature tests..."
@@ -133,11 +129,6 @@ jobs:
               make clean setup start-services wait-for-services
               go test -v -timeout 15m -run "TestS3IAMPolicyEnforcement|TestS3IAMBucketPolicy|TestS3IAMContextual" ./...
               ;;
-            "group")
-              echo "Running IAM group management tests..."
-              make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestIAMGroup" ./...
-              ;;
             *)
               echo "Unknown test type: ${{ matrix.test-type }}"
               exit 1

.github/workflows/s3-parquet-tests.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: ^1.25
+          go-version: ^1.24
           cache: true
       
       - name: Set up Python ${{ matrix.python-version }}
@@ -148,7 +148,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: ^1.25
+          go-version: ^1.24
           cache: true
       
       - name: Run Go unit tests

.github/workflows/s3-proxy-signature-tests.yml

@@ -29,7 +29,7 @@ jobs:
         id: go
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Build SeaweedFS binary for Linux
         run: |

.github/workflows/s3-spark-tests.yml

@@ -33,7 +33,7 @@ jobs:
         id: go
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Install SeaweedFS
         run: |

.github/workflows/s3-tables-tests.yml

@@ -144,7 +144,7 @@ jobs:
         id: go
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Pre-pull Trino image
         run: docker pull trinodb/trino:479
@@ -271,7 +271,7 @@ jobs:
         id: go
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Pre-pull Spark image
         run: docker pull apache/spark:3.5.1
@@ -337,7 +337,7 @@ jobs:
         id: go
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Pre-pull RisingWave image
         run: |
@@ -405,7 +405,7 @@ jobs:
         id: go
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Pre-pull Python image
         run: docker pull python:3
@@ -471,7 +471,7 @@ jobs:
         id: go
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Pre-pull Python image
         run: docker pull python:3

.github/workflows/sftp-tests.yml

@@ -24,6 +24,7 @@ permissions:
   contents: read
 
 env:
+  GO_VERSION: '1.24'
   TEST_TIMEOUT: '15m'
 
 jobs:
@@ -36,10 +37,10 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v6
       
-    - name: Set up Go
+    - name: Set up Go ${{ env.GO_VERSION }}
       uses: actions/setup-go@v6
       with:
-        go-version-file: 'go.mod'
+        go-version: ${{ env.GO_VERSION }}
         
     - name: Install dependencies
       run: |

.github/workflows/spark-integration-tests.yml

@@ -43,7 +43,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v6
       with:
-        go-version-file: 'go.mod'
+        go-version: '1.24'
 
     - name: Build SeaweedFS binary
       run: |

.github/workflows/test-s3-over-https-using-awscli.yml

@@ -24,7 +24,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: ^1.25
+          go-version: ^1.24
 
       - name: Build SeaweedFS
         run: |

.github/workflows/volume-server-integration-tests.yml

@@ -28,6 +28,7 @@ permissions:
   contents: read
 
 env:
+  GO_VERSION: '1.24'
   TEST_TIMEOUT: '30m'
 
 jobs:
@@ -45,10 +46,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
 
-      - name: Set up Go
+      - name: Set up Go ${{ env.GO_VERSION }}
         uses: actions/setup-go@v6
         with:
-          go-version-file: 'go.mod'
+          go-version: ${{ env.GO_VERSION }}
 
       - name: Build SeaweedFS binary
         run: |

docker/Dockerfile.foundationdb_large

@@ -1,4 +1,4 @@
-FROM golang:1.25 AS builder
+FROM golang:1.24 AS builder
 
 RUN apt-get update && \
     apt-get install -y build-essential wget ca-certificates && \

docker/Dockerfile.go_build

@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine as builder
 RUN apk add git g++ fuse
 RUN mkdir -p /go/src/github.com/seaweedfs/
 ARG BRANCH=${BRANCH:-master}

docker/Dockerfile.rocksdb_dev_env

@@ -1,4 +1,4 @@
-FROM golang:1.25 AS builder
+FROM golang:1.24 AS builder
 
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev

docker/Dockerfile.rocksdb_large

@@ -1,4 +1,4 @@
-FROM golang:1.25 AS builder
+FROM golang:1.24 AS builder
 
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev

go.mod

@@ -1,6 +1,6 @@
 module github.com/seaweedfs/seaweedfs
 
-go 1.25.0
+go 1.24.9
 
 require (
 	cloud.google.com/go v0.123.0 // indirect
@@ -63,7 +63,7 @@ require (
 	github.com/prometheus/client_golang v1.23.2
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.2 // indirect
-	github.com/prometheus/procfs v0.20.1
+	github.com/prometheus/procfs v0.19.2
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/seaweedfs/goexif v1.0.3
@@ -87,7 +87,7 @@ require (
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	go.etcd.io/etcd/client/v3 v3.6.7
-	go.mongodb.org/mongo-driver v1.17.9
+	go.mongodb.org/mongo-driver v1.17.6
 	go.opencensus.io v0.24.0 // indirect
 	gocloud.dev v0.45.0
 	gocloud.dev/pubsub/natspubsub v0.45.0
@@ -97,7 +97,7 @@ require (
 	golang.org/x/image v0.36.0
 	golang.org/x/net v0.49.0
 	golang.org/x/oauth2 v0.35.0
-	golang.org/x/sys v0.42.0
+	golang.org/x/sys v0.41.0
 	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/tools v0.41.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
@@ -124,13 +124,13 @@ require (
 	github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3
 	github.com/arangodb/go-driver v1.6.9
 	github.com/armon/go-metrics v0.4.1
-	github.com/aws/aws-sdk-go-v2 v1.41.3
+	github.com/aws/aws-sdk-go-v2 v1.41.1
 	github.com/aws/aws-sdk-go-v2/config v1.32.7
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.7
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0
 	github.com/cognusion/imaging v1.0.2
 	github.com/fluent/fluent-logger-golang v1.10.1
-	github.com/getsentry/sentry-go v0.43.0
+	github.com/getsentry/sentry-go v0.42.0
 	github.com/go-ldap/ldap/v3 v3.4.12
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/flatbuffers/go v0.0.0-20230108230133-3b8644d32c50
@@ -341,7 +341,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6
-	github.com/aws/smithy-go v1.24.2
+	github.com/aws/smithy-go v1.24.0
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/bradenaw/juniper v0.15.3 // indirect
 	github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 // indirect

k8s/charts/seaweedfs/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 description: SeaweedFS
 name: seaweedfs
-appVersion: "4.17"
+appVersion: "4.15"
 # Dev note: Trigger a helm chart release by `git tag -a helm-<version>`
-version: 4.17.0
+version: 4.15.0

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml

@@ -243,7 +243,8 @@ spec:
               {{- if $httpsPort }}
               -s3.port.https={{ $httpsPort }} \
               {{- end }}
-              {{ include "seaweedfs.s3.tlsArgs" (dict "root" . "prefix" "s3.") | nindent 14 }}
+              -s3.cert.file=/usr/local/share/ca-certificates/client/tls.crt \
+              -s3.key.file=/usr/local/share/ca-certificates/client/tls.key \
               {{- end }}
               {{- if or .Values.allInOne.s3.enableAuth .Values.s3.enableAuth .Values.filer.s3.enableAuth }}
               -s3.config=/etc/sw/s3/seaweedfs_s3_config \
@@ -345,9 +346,6 @@ spec:
             - name: client-cert
               mountPath: /usr/local/share/ca-certificates/client/
               readOnly: true
-            {{- if .Values.allInOne.s3.enabled }}
-            {{- include "seaweedfs.s3.tlsVolumeMount" . | nindent 12 }}
-            {{- end }}
             {{- end }}
             {{ tpl .Values.allInOne.extraVolumeMounts . | nindent 12 }}
           ports:
@@ -475,9 +473,6 @@ spec:
         - name: client-cert
           secret:
             secretName: {{ include "seaweedfs.fullname" . }}-client-cert
-        {{- if .Values.allInOne.s3.enabled }}
-        {{- include "seaweedfs.s3.tlsVolume" . | nindent 8 }}
-        {{- end }}
         {{- end }}
         {{ tpl .Values.allInOne.extraVolumes . | nindent 8 }}
       {{- if .Values.allInOne.nodeSelector }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml

@@ -17,9 +17,6 @@ metadata:
 spec:
   type: {{ .Values.allInOne.service.type | default "ClusterIP" }}
   internalTrafficPolicy: {{ .Values.allInOne.service.internalTrafficPolicy | default "Cluster" }}
-  {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) .Values.allInOne.s3.trafficDistribution }}
-  trafficDistribution: {{ include "seaweedfs.trafficDistribution" (dict "value" .Values.allInOne.s3.trafficDistribution "Capabilities" .Capabilities) }}
-  {{- end }}
   ports:
   # Master ports
   - name: "swfs-master"

k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml

@@ -200,7 +200,8 @@ spec:
               {{- if .Values.filer.s3.httpsPort }}
               -s3.port.https={{ .Values.filer.s3.httpsPort }} \
               {{- end }}
-              {{ include "seaweedfs.s3.tlsArgs" (dict "root" . "prefix" "s3.") | nindent 14 }}
+              -s3.cert.file=/usr/local/share/ca-certificates/client/tls.crt \
+              -s3.key.file=/usr/local/share/ca-certificates/client/tls.key \
               {{- end }}
               {{- if .Values.filer.s3.enableAuth }}
               -s3.config=/etc/sw/seaweedfs_s3_config \
@@ -253,9 +254,6 @@ spec:
             - name: client-cert
               readOnly: true
               mountPath: /usr/local/share/ca-certificates/client
-            {{- if .Values.filer.s3.enabled }}
-            {{- include "seaweedfs.s3.tlsVolumeMount" . | nindent 12 }}
-            {{- end }}
             {{- end }}
             {{ tpl .Values.filer.extraVolumeMounts . | nindent 12 | trim }}
           ports:
@@ -386,9 +384,6 @@ spec:
         - name: client-cert
           secret:
             secretName: {{ include "seaweedfs.fullname" . }}-client-cert
-        {{- if .Values.filer.s3.enabled }}
-        {{- include "seaweedfs.s3.tlsVolume" . | nindent 8 }}
-        {{- end }}
         {{- end }}
         {{ tpl .Values.filer.extraVolumes . | indent 8 | trim }}
       {{- if .Values.filer.nodeSelector }}

k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml

@@ -127,7 +127,8 @@ spec:
               {{- if .Values.s3.httpsPort }}
               -port.https={{ .Values.s3.httpsPort }} \
               {{- end }}
-              {{ include "seaweedfs.s3.tlsArgs" (dict "root" . "prefix" "") | nindent 14 }}
+              -cert.file=/usr/local/share/ca-certificates/client/tls.crt \
+              -key.file=/usr/local/share/ca-certificates/client/tls.key \
               {{- end }}
               {{- if .Values.s3.domainName }}
               -domainName={{ .Values.s3.domainName }} \
@@ -175,7 +176,6 @@ spec:
             - name: client-cert
               readOnly: true
               mountPath: /usr/local/share/ca-certificates/client/
-            {{- include "seaweedfs.s3.tlsVolumeMount" . | nindent 12 }}
             {{- end }}
             {{ tpl .Values.s3.extraVolumeMounts . | nindent 12 | trim }}
           ports:
@@ -267,7 +267,6 @@ spec:
         - name: client-cert
           secret:
             secretName: {{ include "seaweedfs.fullname" . }}-client-cert
-        {{- include "seaweedfs.s3.tlsVolume" . | nindent 8 }}
         {{- end }}
         {{ tpl .Values.s3.extraVolumes . | indent 8 | trim }}
       {{- if .Values.s3.nodeSelector }}

k8s/charts/seaweedfs/templates/s3/s3-service.yaml

@@ -16,9 +16,8 @@ metadata:
 {{- end }}
 spec:
   internalTrafficPolicy: {{ .Values.s3.internalTrafficPolicy | default "Cluster" }}
-  {{- $td := .Values.s3.trafficDistribution | default .Values.filer.s3.trafficDistribution }}
-  {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) $td }}
-  trafficDistribution: {{ include "seaweedfs.trafficDistribution" (dict "value" $td "Capabilities" .Capabilities) }}
+  {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) (or .Values.s3.trafficDistribution .Values.filer.s3.trafficDistribution) }}
+  trafficDistribution: {{ include "seaweedfs.trafficDistribution" . }}
   {{- end }}
   ports:
   - name: "swfs-s3"

k8s/charts/seaweedfs/templates/shared/_helpers.tpl

@@ -338,41 +338,11 @@ Create the name of the service account to use
 {{- .Values.global.serviceAccountName | default "seaweedfs" -}}
 {{- end -}}
 
-{{/* S3 TLS cert/key arguments, using custom secret if s3.tlsSecret is set */}}
-{{- define "seaweedfs.s3.tlsArgs" -}}
-{{- $prefix := .prefix -}}
-{{- $root := .root -}}
-{{- if $root.Values.s3.tlsSecret -}}
--{{ $prefix }}cert.file=/usr/local/share/ca-certificates/s3/tls.crt \
--{{ $prefix }}key.file=/usr/local/share/ca-certificates/s3/tls.key \
-{{- else -}}
--{{ $prefix }}cert.file=/usr/local/share/ca-certificates/client/tls.crt \
--{{ $prefix }}key.file=/usr/local/share/ca-certificates/client/tls.key \
-{{- end -}}
-{{- end -}}
-
-{{/* S3 custom TLS volume mount */}}
-{{- define "seaweedfs.s3.tlsVolumeMount" -}}
-{{- if .Values.s3.tlsSecret }}
-- name: s3-tls-cert
-  readOnly: true
-  mountPath: /usr/local/share/ca-certificates/s3/
-{{- end }}
-{{- end -}}
-
-{{/* S3 custom TLS volume */}}
-{{- define "seaweedfs.s3.tlsVolume" -}}
-{{- if .Values.s3.tlsSecret }}
-- name: s3-tls-cert
-  secret:
-    secretName: {{ .Values.s3.tlsSecret }}
-{{- end }}
-{{- end -}}
-
-{{/* Generate a compatible trafficDistribution value due to "PreferClose" fast deprecation in k8s v1.35.
-     Accepts a dict with "value" (the trafficDistribution string) and "Capabilities". */}}
+{{/* Generate a compatible trafficDistribution value due to "PreferClose" fast deprecation in k8s v1.35 */}}
 {{- define "seaweedfs.trafficDistribution" -}}
-{{- if .value -}}
-{{- and (eq .value "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .value -}}
+{{- if .Values.s3.trafficDistribution -}}
+{{- and (eq .Values.s3.trafficDistribution "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .Values.s3.trafficDistribution -}}
+{{- else if .Values.filer.s3.trafficDistribution -}}
+{{- and (eq .Values.filer.s3.trafficDistribution "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .Values.filer.s3.trafficDistribution -}}
 {{- end -}}
 {{- end -}}

k8s/charts/seaweedfs/values.yaml

@@ -919,13 +919,6 @@ s3:
   port: 8333
   # add additional https port
   httpsPort: 0
-  # Use a custom TLS certificate secret for the S3 HTTPS endpoint.
-  # When set, this Kubernetes Secret (must contain tls.crt and tls.key) is used
-  # instead of the internal self-signed client certificate generated by cert-manager.
-  # This allows using a publicly trusted certificate (e.g., from Let's Encrypt)
-  # so that S3 clients don't need to trust the internal CA.
-  # Requires global.enableSecurity to be true.
-  tlsSecret: null
   metricsPort: 9327
   # Iceberg catalog REST port (Apache Iceberg REST Catalog API)
   # Set to a port number to enable, or 0/null to disable
@@ -1460,7 +1453,6 @@ allInOne:
     # The s3-secret.yaml template only reads from .Values.s3.credentials.
     # See: s3.credentials.admin.accessKey, s3.credentials.read.accessKey
     auditLogConfig: null  # S3 audit log configuration (null inherits from s3.auditLogConfig)
-    trafficDistribution: null  # Service traffic distribution (e.g., "PreferClose"); auto-converts to "PreferSameZone" on k8s >=1.35
     # You may specify buckets to be created during the install process.
     # Buckets may be exposed publicly by setting `anonymousRead` to `true`
     # ttl format: [1-255][m|h|d|w|M|y] (e.g., 7d)

seaweedfs-rdma-sidecar/Dockerfile.sidecar

@@ -1,5 +1,5 @@
 # Multi-stage build for Go Sidecar
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git ca-certificates tzdata

seaweedfs-rdma-sidecar/Dockerfile.test-client

@@ -1,5 +1,5 @@
 # Multi-stage build for Test Client
-FROM golang:1.25-alpine AS builder
+FROM golang:1.23-alpine AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git ca-certificates tzdata

test/erasure_coding/admin_dockertest/ec_integration_test.go

@@ -194,6 +194,28 @@ func TestEcEndToEnd(t *testing.T) {
 	// 1. Configure plugin job types for fast EC detection/execution.
 	t.Log("Configuring plugin job types via API...")
 
+	schedulerConfig := map[string]interface{}{
+		"idle_sleep_seconds": 1,
+	}
+	jsonBody, err := json.Marshal(schedulerConfig)
+	if err != nil {
+		t.Fatalf("Failed to marshal scheduler config: %v", err)
+	}
+	req, err := http.NewRequest("PUT", AdminUrl+"/api/plugin/scheduler-config", bytes.NewBuffer(jsonBody))
+	if err != nil {
+		t.Fatalf("Failed to create scheduler config request: %v", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatalf("Failed to update scheduler config: %v", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		t.Fatalf("Failed to update scheduler config (status %d): %s", resp.StatusCode, string(body))
+	}
+	resp.Body.Close()
+
 	// Disable volume balance to reduce interference for this EC-focused test.
 	balanceConfig := map[string]interface{}{
 		"job_type": "volume_balance",
@@ -201,16 +223,16 @@ func TestEcEndToEnd(t *testing.T) {
 			"enabled": false,
 		},
 	}
-	jsonBody, err := json.Marshal(balanceConfig)
+	jsonBody, err = json.Marshal(balanceConfig)
 	if err != nil {
 		t.Fatalf("Failed to marshal volume_balance config: %v", err)
 	}
-	req, err := http.NewRequest("PUT", AdminUrl+"/api/plugin/job-types/volume_balance/config", bytes.NewBuffer(jsonBody))
+	req, err = http.NewRequest("PUT", AdminUrl+"/api/plugin/job-types/volume_balance/config", bytes.NewBuffer(jsonBody))
 	if err != nil {
 		t.Fatalf("Failed to create volume_balance config request: %v", err)
 	}
 	req.Header.Set("Content-Type", "application/json")
-	resp, err := client.Do(req)
+	resp, err = client.Do(req)
 	if err != nil {
 		t.Fatalf("Failed to update volume_balance config: %v", err)
 	}

test/foundationdb/Dockerfile.build

@@ -1,6 +1,6 @@
 # Simplified single-stage build for SeaweedFS with FoundationDB support
 # Force x86_64 platform to use AMD64 FoundationDB packages
-FROM --platform=linux/amd64 golang:1.25-bookworm
+FROM --platform=linux/amd64 golang:1.24-bookworm
 
 ARG FOUNDATIONDB_VERSION=7.4.5
 ENV FOUNDATIONDB_VERSION=${FOUNDATIONDB_VERSION}

test/foundationdb/Dockerfile.build.arm64

@@ -1,5 +1,5 @@
 # Multi-stage Dockerfile to build SeaweedFS with FoundationDB support for ARM64
-FROM --platform=linux/arm64 golang:1.25-bookworm AS builder
+FROM --platform=linux/arm64 golang:1.24-bookworm AS builder
 
 ARG FOUNDATIONDB_VERSION=7.4.5
 ENV FOUNDATIONDB_VERSION=${FOUNDATIONDB_VERSION}

test/foundationdb/Dockerfile.test

@@ -1,5 +1,5 @@
 # Test environment with Go and FoundationDB support
-FROM golang:1.25-bookworm
+FROM golang:1.24-bookworm
 
 # Install system dependencies
 RUN apt-get update && apt-get install -y \

test/java/spark/pom.xml

@@ -123,7 +123,7 @@
             <dependency>
                 <groupId>org.apache.zookeeper</groupId>
                 <artifactId>zookeeper</artifactId>
-                <version>3.9.5</version>
+                <version>3.9.4</version>
             </dependency>
 
             <!-- Apache Commons - Fix CVEs -->

test/kafka/Dockerfile.kafka-gateway

@@ -1,5 +1,5 @@
 # Dockerfile for Kafka Gateway Integration Testing
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git make gcc musl-dev sqlite-dev

test/kafka/Dockerfile.seaweedfs

@@ -1,5 +1,5 @@
 # Dockerfile for building SeaweedFS components from the current workspace
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder
 
 RUN apk add --no-cache git make gcc musl-dev sqlite-dev
 

test/kafka/Dockerfile.test-setup

@@ -1,5 +1,5 @@
 # Dockerfile for Kafka Integration Test Setup
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git make gcc musl-dev

test/kafka/kafka-client-loadtest/Dockerfile.loadtest

@@ -2,7 +2,7 @@
 # Multi-stage build for cross-platform support
 
 # Stage 1: Builder
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder
 
 WORKDIR /app
 

test/plugin_workers/fake_volume_server.go

@@ -27,21 +27,19 @@ type VolumeServer struct {
 	address  string
 	baseDir  string
 
-	mu                  sync.Mutex
-	receivedFiles       map[string]uint64
-	mountRequests       []*volume_server_pb.VolumeEcShardsMountRequest
-	deleteRequests      []*volume_server_pb.VolumeDeleteRequest
-	markReadonlyCalls   int
-	markWritableCalls   int
-	readFileStatusCalls int
-	vacuumGarbageRatio  float64
-	vacuumCheckCalls    int
-	vacuumCompactCalls  int
-	vacuumCommitCalls   int
-	vacuumCleanupCalls  int
-	volumeCopyCalls     int
-	volumeMountCalls    int
-	tailReceiverCalls   int
+	mu                 sync.Mutex
+	receivedFiles      map[string]uint64
+	mountRequests      []*volume_server_pb.VolumeEcShardsMountRequest
+	deleteRequests     []*volume_server_pb.VolumeDeleteRequest
+	markReadonlyCalls  int
+	vacuumGarbageRatio float64
+	vacuumCheckCalls   int
+	vacuumCompactCalls int
+	vacuumCommitCalls  int
+	vacuumCleanupCalls int
+	volumeCopyCalls    int
+	volumeMountCalls   int
+	tailReceiverCalls  int
 }
 
 // NewVolumeServer starts a test volume server using the provided base directory.
@@ -153,20 +151,6 @@ func (v *VolumeServer) MarkReadonlyCount() int {
 	return v.markReadonlyCalls
 }
 
-// MarkWritableCount returns the number of writable calls.
-func (v *VolumeServer) MarkWritableCount() int {
-	v.mu.Lock()
-	defer v.mu.Unlock()
-	return v.markWritableCalls
-}
-
-// ReadFileStatusCount returns the number of ReadVolumeFileStatus calls.
-func (v *VolumeServer) ReadFileStatusCount() int {
-	v.mu.Lock()
-	defer v.mu.Unlock()
-	return v.readFileStatusCalls
-}
-
 // Shutdown stops the volume server.
 func (v *VolumeServer) Shutdown() {
 	if v.server != nil {
@@ -296,25 +280,6 @@ func (v *VolumeServer) VolumeMarkReadonly(ctx context.Context, req *volume_serve
 	return &volume_server_pb.VolumeMarkReadonlyResponse{}, nil
 }
 
-func (v *VolumeServer) VolumeMarkWritable(ctx context.Context, req *volume_server_pb.VolumeMarkWritableRequest) (*volume_server_pb.VolumeMarkWritableResponse, error) {
-	v.mu.Lock()
-	v.markWritableCalls++
-	v.mu.Unlock()
-	return &volume_server_pb.VolumeMarkWritableResponse{}, nil
-}
-
-func (v *VolumeServer) ReadVolumeFileStatus(ctx context.Context, req *volume_server_pb.ReadVolumeFileStatusRequest) (*volume_server_pb.ReadVolumeFileStatusResponse, error) {
-	v.mu.Lock()
-	v.readFileStatusCalls++
-	v.mu.Unlock()
-	return &volume_server_pb.ReadVolumeFileStatusResponse{
-		VolumeId:    req.VolumeId,
-		DatFileSize: 1024,
-		IdxFileSize: 16,
-		FileCount:   1,
-	}, nil
-}
-
 func (v *VolumeServer) VacuumVolumeCheck(ctx context.Context, req *volume_server_pb.VacuumVolumeCheckRequest) (*volume_server_pb.VacuumVolumeCheckResponse, error) {
 	v.mu.Lock()
 	v.vacuumCheckCalls++

test/plugin_workers/volume_balance/detection_test.go

@@ -37,9 +37,7 @@ func TestVolumeBalanceDetectionIntegration(t *testing.T) {
 		MasterGrpcAddresses: []string{master.Address()},
 	}, 10)
 	require.NoError(t, err)
-	// With default batch_size=20 and 10 overloaded volumes vs 1 underloaded,
-	// all moves are grouped into a single batch proposal.
-	require.Len(t, proposals, 1, "expected exactly one batch proposal")
+	require.Len(t, proposals, 1)
 
 	proposal := proposals[0]
 	require.Equal(t, "volume_balance", proposal.JobType)
@@ -48,15 +46,8 @@ func TestVolumeBalanceDetectionIntegration(t *testing.T) {
 
 	params := &worker_pb.TaskParams{}
 	require.NoError(t, proto.Unmarshal(paramsValue.GetBytesValue(), params))
-
-	bp := params.GetBalanceParams()
-	require.NotNil(t, bp, "expected BalanceParams in batch proposal")
-	require.Greater(t, len(bp.Moves), 1, "batch proposal should contain multiple moves")
-	for _, move := range bp.Moves {
-		require.NotZero(t, move.VolumeId)
-		require.NotEmpty(t, move.SourceNode)
-		require.NotEmpty(t, move.TargetNode)
-	}
+	require.NotEmpty(t, params.Sources)
+	require.NotEmpty(t, params.Targets)
 }
 
 func buildBalanceVolumeListResponse(t *testing.T) *master_pb.VolumeListResponse {

test/plugin_workers/volume_balance/execution_test.go

@@ -8,12 +8,10 @@ import (
 
 	pluginworkers "github.com/seaweedfs/seaweedfs/test/plugin_workers"
 	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
 	pluginworker "github.com/seaweedfs/seaweedfs/weed/plugin/worker"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/protobuf/proto"
 )
 
 func TestVolumeBalanceExecutionIntegration(t *testing.T) {
@@ -62,92 +60,8 @@ func TestVolumeBalanceExecutionIntegration(t *testing.T) {
 	require.GreaterOrEqual(t, source.MarkReadonlyCount(), 1)
 	require.GreaterOrEqual(t, len(source.DeleteRequests()), 1)
 
-	copyCalls, _, tailCalls := target.BalanceStats()
+	copyCalls, mountCalls, tailCalls := target.BalanceStats()
 	require.GreaterOrEqual(t, copyCalls, 1)
+	require.GreaterOrEqual(t, mountCalls, 1)
 	require.GreaterOrEqual(t, tailCalls, 1)
 }
-
-func TestVolumeBalanceBatchExecutionIntegration(t *testing.T) {
-	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
-	handler := pluginworker.NewVolumeBalanceHandler(dialOption)
-	harness := pluginworkers.NewHarness(t, pluginworkers.HarnessConfig{
-		WorkerOptions: pluginworker.WorkerOptions{
-			GrpcDialOption: dialOption,
-		},
-		Handlers: []pluginworker.JobHandler{handler},
-	})
-	harness.WaitForJobType("volume_balance")
-
-	// Create one source and one target fake volume server.
-	source := pluginworkers.NewVolumeServer(t, "")
-	target := pluginworkers.NewVolumeServer(t, "")
-
-	// Build a batch job with 3 volume moves from source → target.
-	volumeIDs := []uint32{401, 402, 403}
-	moves := make([]*worker_pb.BalanceMoveSpec, len(volumeIDs))
-	for i, vid := range volumeIDs {
-		moves[i] = &worker_pb.BalanceMoveSpec{
-			VolumeId:   vid,
-			SourceNode: source.Address(),
-			TargetNode: target.Address(),
-			Collection: "batch-test",
-		}
-	}
-
-	params := &worker_pb.TaskParams{
-		TaskId: "batch-balance-test",
-		TaskParams: &worker_pb.TaskParams_BalanceParams{
-			BalanceParams: &worker_pb.BalanceTaskParams{
-				MaxConcurrentMoves: 2,
-				Moves:              moves,
-			},
-		},
-	}
-	paramBytes, err := proto.Marshal(params)
-	require.NoError(t, err)
-
-	job := &plugin_pb.JobSpec{
-		JobId:   "batch-balance-test",
-		JobType: "volume_balance",
-		Parameters: map[string]*plugin_pb.ConfigValue{
-			"task_params_pb": {
-				Kind: &plugin_pb.ConfigValue_BytesValue{BytesValue: paramBytes},
-			},
-		},
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	result, err := harness.Plugin().ExecuteJob(ctx, job, nil, 1)
-	require.NoError(t, err)
-	require.NotNil(t, result)
-	require.True(t, result.Success, "batch balance job should succeed; result: %+v", result)
-
-	// Each of the 3 moves should have marked the source readonly and deleted.
-	require.Equal(t, len(volumeIDs), source.MarkReadonlyCount(),
-		"each move should mark source volume readonly")
-	require.Equal(t, len(volumeIDs), len(source.DeleteRequests()),
-		"each move should delete the source volume")
-
-	// Verify delete requests reference the expected volume IDs.
-	deletedVols := make(map[uint32]bool)
-	for _, req := range source.DeleteRequests() {
-		deletedVols[req.VolumeId] = true
-	}
-	for _, vid := range volumeIDs {
-		require.True(t, deletedVols[vid], "volume %d should have been deleted from source", vid)
-	}
-
-	// Pre-delete verification should have called ReadVolumeFileStatus on both
-	// source and target for each volume.
-	require.Equal(t, len(volumeIDs), source.ReadFileStatusCount(),
-		"each move should read source volume status before delete")
-	require.Equal(t, len(volumeIDs), target.ReadFileStatusCount(),
-		"each move should read target volume status before delete")
-
-	// Target should have received copy and tail calls for all 3 volumes.
-	copyCalls, _, tailCalls := target.BalanceStats()
-	require.Equal(t, len(volumeIDs), copyCalls, "target should receive one copy per volume")
-	require.Equal(t, len(volumeIDs), tailCalls, "target should receive one tail per volume")
-}

test/postgres/Dockerfile.client

@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder
 
 # Set working directory
 WORKDIR /app

test/postgres/Dockerfile.producer

@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder
 
 # Set working directory
 WORKDIR /app

test/postgres/Dockerfile.seaweedfs

@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder
 
 # Install git and other build dependencies
 RUN apk add --no-cache git make

test/s3/cors/s3_cors_test.go

@@ -140,7 +140,7 @@ func TestCORSConfigurationManagement(t *testing.T) {
 		Bucket:            aws.String(bucketName),
 		CORSConfiguration: corsConfig,
 	})
-	require.NoError(t, err, "Should be able to put CORS configuration")
+	assert.NoError(t, err, "Should be able to put CORS configuration")
 
 	// Wait for metadata subscription to update cache
 	time.Sleep(50 * time.Millisecond)
@@ -149,9 +149,9 @@ func TestCORSConfigurationManagement(t *testing.T) {
 	getResp, err := client.GetBucketCors(context.TODO(), &s3.GetBucketCorsInput{
 		Bucket: aws.String(bucketName),
 	})
-	require.NoError(t, err, "Should be able to get CORS configuration")
-	require.NotNil(t, getResp.CORSRules, "CORS configuration should not be nil")
-	require.Len(t, getResp.CORSRules, 1, "Should have one CORS rule")
+	assert.NoError(t, err, "Should be able to get CORS configuration")
+	assert.NotNil(t, getResp.CORSRules, "CORS configuration should not be nil")
+	assert.Len(t, getResp.CORSRules, 1, "Should have one CORS rule")
 
 	rule := getResp.CORSRules[0]
 	assert.Equal(t, []string{"*"}, rule.AllowedHeaders, "Allowed headers should match")

test/s3/iam/Dockerfile.s3

@@ -1,5 +1,5 @@
 # Multi-stage build for SeaweedFS S3 with IAM
-FROM golang:1.25-alpine AS builder
+FROM golang:1.23-alpine AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git make curl wget

test/s3/iam/Makefile

@@ -185,9 +185,6 @@ test-context: ## Test only contextual policy enforcement
 test-presigned: ## Test only presigned URL integration
 	go test -v -run TestS3IAMPresignedURLIntegration ./...
 
-test-group: ## Run IAM group management tests
-	go test -v -run "TestIAMGroup" ./...
-
 test-sts: ## Run all STS tests
 	go test -v -run "TestSTS" ./...
 
@@ -266,7 +263,7 @@ docker-build: ## Build custom SeaweedFS image for Docker tests
 
 # All PHONY targets
 .PHONY: test test-quick run-tests setup start-services stop-services wait-for-services clean logs status debug
-.PHONY: test-auth test-policy test-expiration test-multipart test-bucket-policy test-context test-presigned test-group test-sts test-sts-assume-role test-sts-ldap  
+.PHONY: test-auth test-policy test-expiration test-multipart test-bucket-policy test-context test-presigned test-sts test-sts-assume-role test-sts-ldap  
 .PHONY: benchmark ci watch install-deps docker-test docker-up docker-down docker-logs docker-build
 .PHONY: test-distributed test-performance test-stress test-versioning-stress test-keycloak-full test-all-previously-skipped setup-all-tests help-advanced
 

test/s3/iam/s3_iam_group_test.go

@@ -1,792 +0,0 @@
-package iam
-
-import (
-	"encoding/xml"
-	"io"
-	"net/http"
-	"net/url"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestIAMGroupLifecycle tests the full lifecycle of group management:
-// CreateGroup, GetGroup, ListGroups, DeleteGroup
-func TestIAMGroupLifecycle(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	groupName := "test-group-lifecycle"
-
-	t.Run("create_group", func(t *testing.T) {
-		resp, err := iamClient.CreateGroup(&iam.CreateGroupInput{
-			GroupName: aws.String(groupName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, groupName, *resp.Group.GroupName)
-	})
-
-	t.Run("get_group", func(t *testing.T) {
-		resp, err := iamClient.GetGroup(&iam.GetGroupInput{
-			GroupName: aws.String(groupName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, groupName, *resp.Group.GroupName)
-	})
-
-	t.Run("list_groups_contains_created", func(t *testing.T) {
-		resp, err := iamClient.ListGroups(&iam.ListGroupsInput{})
-		require.NoError(t, err)
-		found := false
-		for _, g := range resp.Groups {
-			if *g.GroupName == groupName {
-				found = true
-				break
-			}
-		}
-		assert.True(t, found, "Created group should appear in ListGroups")
-	})
-
-	t.Run("create_duplicate_group_fails", func(t *testing.T) {
-		_, err := iamClient.CreateGroup(&iam.CreateGroupInput{
-			GroupName: aws.String(groupName),
-		})
-		assert.Error(t, err, "Creating a duplicate group should fail")
-	})
-
-	t.Run("delete_group", func(t *testing.T) {
-		_, err := iamClient.DeleteGroup(&iam.DeleteGroupInput{
-			GroupName: aws.String(groupName),
-		})
-		require.NoError(t, err)
-
-		// Verify it's gone
-		resp, err := iamClient.ListGroups(&iam.ListGroupsInput{})
-		require.NoError(t, err)
-		for _, g := range resp.Groups {
-			assert.NotEqual(t, groupName, *g.GroupName,
-				"Deleted group should not appear in ListGroups")
-		}
-	})
-
-	t.Run("delete_nonexistent_group_fails", func(t *testing.T) {
-		_, err := iamClient.DeleteGroup(&iam.DeleteGroupInput{
-			GroupName: aws.String("nonexistent-group-xyz"),
-		})
-		assert.Error(t, err)
-	})
-}
-
-// TestIAMGroupMembership tests adding and removing users from groups
-func TestIAMGroupMembership(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	groupName := "test-group-members"
-	userName := "test-user-for-group"
-
-	// Setup: create group and user
-	_, err = iamClient.CreateGroup(&iam.CreateGroupInput{
-		GroupName: aws.String(groupName),
-	})
-	require.NoError(t, err)
-	defer iamClient.DeleteGroup(&iam.DeleteGroupInput{GroupName: aws.String(groupName)})
-
-	_, err = iamClient.CreateUser(&iam.CreateUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-	defer iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)})
-
-	t.Run("add_user_to_group", func(t *testing.T) {
-		_, err := iamClient.AddUserToGroup(&iam.AddUserToGroupInput{
-			GroupName: aws.String(groupName),
-			UserName:  aws.String(userName),
-		})
-		require.NoError(t, err)
-	})
-
-	t.Run("get_group_shows_member", func(t *testing.T) {
-		resp, err := iamClient.GetGroup(&iam.GetGroupInput{
-			GroupName: aws.String(groupName),
-		})
-		require.NoError(t, err)
-		found := false
-		for _, u := range resp.Users {
-			if *u.UserName == userName {
-				found = true
-				break
-			}
-		}
-		assert.True(t, found, "Added user should appear in GetGroup members")
-	})
-
-	t.Run("list_groups_for_user", func(t *testing.T) {
-		resp, err := iamClient.ListGroupsForUser(&iam.ListGroupsForUserInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		found := false
-		for _, g := range resp.Groups {
-			if *g.GroupName == groupName {
-				found = true
-				break
-			}
-		}
-		assert.True(t, found, "Group should appear in ListGroupsForUser")
-	})
-
-	t.Run("add_duplicate_member_is_idempotent", func(t *testing.T) {
-		_, err := iamClient.AddUserToGroup(&iam.AddUserToGroupInput{
-			GroupName: aws.String(groupName),
-			UserName:  aws.String(userName),
-		})
-		// Should succeed (idempotent) or return a benign error
-		// AWS IAM allows duplicate add without error
-		assert.NoError(t, err)
-	})
-
-	t.Run("remove_user_from_group", func(t *testing.T) {
-		_, err := iamClient.RemoveUserFromGroup(&iam.RemoveUserFromGroupInput{
-			GroupName: aws.String(groupName),
-			UserName:  aws.String(userName),
-		})
-		require.NoError(t, err)
-
-		// Verify removal
-		resp, err := iamClient.GetGroup(&iam.GetGroupInput{
-			GroupName: aws.String(groupName),
-		})
-		require.NoError(t, err)
-		for _, u := range resp.Users {
-			assert.NotEqual(t, userName, *u.UserName,
-				"Removed user should not appear in group members")
-		}
-	})
-}
-
-// TestIAMGroupPolicyAttachment tests attaching and detaching policies from groups
-func TestIAMGroupPolicyAttachment(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	groupName := "test-group-policies"
-	policyName := "test-group-attach-policy"
-	policyDoc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"*"}]}`
-
-	// Setup: create group and policy
-	_, err = iamClient.CreateGroup(&iam.CreateGroupInput{
-		GroupName: aws.String(groupName),
-	})
-	require.NoError(t, err)
-
-	createPolicyResp, err := iamClient.CreatePolicy(&iam.CreatePolicyInput{
-		PolicyName:     aws.String(policyName),
-		PolicyDocument: aws.String(policyDoc),
-	})
-	require.NoError(t, err)
-	policyArn := createPolicyResp.Policy.Arn
-
-	// Cleanup in correct order: detach policy, delete group, delete policy
-	t.Cleanup(func() {
-		if _, err := iamClient.DetachGroupPolicy(&iam.DetachGroupPolicyInput{
-			GroupName: aws.String(groupName),
-			PolicyArn: policyArn,
-		}); err != nil {
-			t.Logf("cleanup: failed to detach group policy: %v", err)
-		}
-		if _, err := iamClient.DeleteGroup(&iam.DeleteGroupInput{GroupName: aws.String(groupName)}); err != nil {
-			t.Logf("cleanup: failed to delete group: %v", err)
-		}
-		if _, err := iamClient.DeletePolicy(&iam.DeletePolicyInput{PolicyArn: policyArn}); err != nil {
-			t.Logf("cleanup: failed to delete policy: %v", err)
-		}
-	})
-
-	t.Run("attach_group_policy", func(t *testing.T) {
-		_, err := iamClient.AttachGroupPolicy(&iam.AttachGroupPolicyInput{
-			GroupName: aws.String(groupName),
-			PolicyArn: policyArn,
-		})
-		require.NoError(t, err)
-	})
-
-	t.Run("list_attached_group_policies", func(t *testing.T) {
-		resp, err := iamClient.ListAttachedGroupPolicies(&iam.ListAttachedGroupPoliciesInput{
-			GroupName: aws.String(groupName),
-		})
-		require.NoError(t, err)
-		found := false
-		for _, p := range resp.AttachedPolicies {
-			if *p.PolicyName == policyName {
-				found = true
-				break
-			}
-		}
-		assert.True(t, found, "Attached policy should appear in ListAttachedGroupPolicies")
-	})
-
-	t.Run("detach_group_policy", func(t *testing.T) {
-		_, err := iamClient.DetachGroupPolicy(&iam.DetachGroupPolicyInput{
-			GroupName: aws.String(groupName),
-			PolicyArn: policyArn,
-		})
-		require.NoError(t, err)
-
-		// Verify detachment
-		resp, err := iamClient.ListAttachedGroupPolicies(&iam.ListAttachedGroupPoliciesInput{
-			GroupName: aws.String(groupName),
-		})
-		require.NoError(t, err)
-		for _, p := range resp.AttachedPolicies {
-			assert.NotEqual(t, policyName, *p.PolicyName,
-				"Detached policy should not appear in ListAttachedGroupPolicies")
-		}
-	})
-}
-
-// TestIAMGroupPolicyEnforcement tests that group policies are enforced during S3 operations.
-// Creates a user with no direct policies, adds them to a group with S3 access,
-// and verifies they can access S3 through the group policy.
-func TestIAMGroupPolicyEnforcement(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	groupName := "test-enforcement-group"
-	userName := "test-enforcement-user"
-	policyName := "test-enforcement-policy"
-	bucketName := "test-group-enforce-bucket"
-	policyDoc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:*"],"Resource":["arn:aws:s3:::` + bucketName + `","arn:aws:s3:::` + bucketName + `/*"]}]}`
-
-	// Create user
-	_, err = iamClient.CreateUser(&iam.CreateUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-
-	// Create access key for the user
-	keyResp, err := iamClient.CreateAccessKey(&iam.CreateAccessKeyInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-
-	accessKeyId := *keyResp.AccessKey.AccessKeyId
-	secretKey := *keyResp.AccessKey.SecretAccessKey
-
-	// Create an S3 client with the user's credentials
-	userS3Client := createS3Client(t, accessKeyId, secretKey)
-
-	// Create group
-	_, err = iamClient.CreateGroup(&iam.CreateGroupInput{
-		GroupName: aws.String(groupName),
-	})
-	require.NoError(t, err)
-
-	// Create policy
-	createPolicyResp, err := iamClient.CreatePolicy(&iam.CreatePolicyInput{
-		PolicyName:     aws.String(policyName),
-		PolicyDocument: aws.String(policyDoc),
-	})
-	require.NoError(t, err)
-	policyArn := createPolicyResp.Policy.Arn
-
-	// Cleanup in correct order: remove user from group, detach policy,
-	// delete access key, delete user, delete group, delete policy
-	t.Cleanup(func() {
-		if _, err := iamClient.RemoveUserFromGroup(&iam.RemoveUserFromGroupInput{
-			GroupName: aws.String(groupName),
-			UserName:  aws.String(userName),
-		}); err != nil {
-			t.Logf("cleanup: failed to remove user from group: %v", err)
-		}
-		if _, err := iamClient.DetachGroupPolicy(&iam.DetachGroupPolicyInput{
-			GroupName: aws.String(groupName),
-			PolicyArn: policyArn,
-		}); err != nil {
-			t.Logf("cleanup: failed to detach group policy: %v", err)
-		}
-		if _, err := iamClient.DeleteAccessKey(&iam.DeleteAccessKeyInput{
-			UserName:    aws.String(userName),
-			AccessKeyId: keyResp.AccessKey.AccessKeyId,
-		}); err != nil {
-			t.Logf("cleanup: failed to delete access key: %v", err)
-		}
-		if _, err := iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)}); err != nil {
-			t.Logf("cleanup: failed to delete user: %v", err)
-		}
-		if _, err := iamClient.DeleteGroup(&iam.DeleteGroupInput{GroupName: aws.String(groupName)}); err != nil {
-			t.Logf("cleanup: failed to delete group: %v", err)
-		}
-		if _, err := iamClient.DeletePolicy(&iam.DeletePolicyInput{PolicyArn: policyArn}); err != nil {
-			t.Logf("cleanup: failed to delete policy: %v", err)
-		}
-	})
-
-	// Register bucket cleanup on parent test with admin credentials
-	// (userS3Client may lack permissions by cleanup time)
-	adminS3, err := framework.CreateS3ClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		if _, err := adminS3.DeleteObject(&s3.DeleteObjectInput{
-			Bucket: aws.String(bucketName),
-			Key:    aws.String("test-key"),
-		}); err != nil {
-			t.Logf("cleanup: failed to delete object: %v", err)
-		}
-		if _, err := adminS3.DeleteBucket(&s3.DeleteBucketInput{Bucket: aws.String(bucketName)}); err != nil {
-			t.Logf("cleanup: failed to delete bucket: %v", err)
-		}
-	})
-
-	t.Run("user_without_group_denied", func(t *testing.T) {
-		// User has no policies and is not in any group — should be denied
-		_, err := userS3Client.CreateBucket(&s3.CreateBucketInput{
-			Bucket: aws.String(bucketName),
-		})
-		require.Error(t, err, "User without any policies should be denied")
-		awsErr, ok := err.(awserr.Error)
-		require.True(t, ok, "Expected awserr.Error")
-		assert.Equal(t, "AccessDenied", awsErr.Code())
-	})
-
-	t.Run("user_with_group_policy_allowed", func(t *testing.T) {
-		// Attach policy to group
-		_, err := iamClient.AttachGroupPolicy(&iam.AttachGroupPolicyInput{
-			GroupName: aws.String(groupName),
-			PolicyArn: policyArn,
-		})
-		require.NoError(t, err)
-
-		// Add user to group
-		_, err = iamClient.AddUserToGroup(&iam.AddUserToGroupInput{
-			GroupName: aws.String(groupName),
-			UserName:  aws.String(userName),
-		})
-		require.NoError(t, err)
-
-		// Wait for policy propagation, then create bucket
-		require.Eventually(t, func() bool {
-			_, err = userS3Client.CreateBucket(&s3.CreateBucketInput{
-				Bucket: aws.String(bucketName),
-			})
-			return err == nil
-		}, 10*time.Second, 500*time.Millisecond, "User with group policy should be allowed")
-
-		// Should also be able to put/get objects
-		_, err = userS3Client.PutObject(&s3.PutObjectInput{
-			Bucket: aws.String(bucketName),
-			Key:    aws.String("test-key"),
-			Body:   aws.ReadSeekCloser(strings.NewReader("test-data")),
-		})
-		require.NoError(t, err, "User should be able to put objects through group policy")
-	})
-
-	t.Run("user_removed_from_group_denied", func(t *testing.T) {
-		// Remove user from group
-		_, err := iamClient.RemoveUserFromGroup(&iam.RemoveUserFromGroupInput{
-			GroupName: aws.String(groupName),
-			UserName:  aws.String(userName),
-		})
-		require.NoError(t, err)
-
-		// Wait for policy propagation — user should now be denied
-		var lastErr error
-		require.Eventually(t, func() bool {
-			_, lastErr = userS3Client.ListObjects(&s3.ListObjectsInput{
-				Bucket: aws.String(bucketName),
-			})
-			return lastErr != nil
-		}, 10*time.Second, 500*time.Millisecond, "User removed from group should be denied")
-		awsErr, ok := lastErr.(awserr.Error)
-		require.True(t, ok, "Expected awserr.Error")
-		assert.Equal(t, "AccessDenied", awsErr.Code())
-	})
-}
-
-// TestIAMGroupDisabledPolicyEnforcement tests that disabled groups do not contribute policies.
-// Uses the raw IAM API (callIAMAPI) since the AWS SDK doesn't support custom group status.
-func TestIAMGroupDisabledPolicyEnforcement(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	if !isSeaweedFSRunning(t) {
-		t.Skip("SeaweedFS is not running at", TestIAMEndpoint)
-	}
-
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	groupName := "test-disabled-group"
-	userName := "test-disabled-grp-user"
-	policyName := "test-disabled-grp-policy"
-	bucketName := "test-disabled-grp-bucket"
-	policyDoc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:*"],"Resource":["arn:aws:s3:::` + bucketName + `","arn:aws:s3:::` + bucketName + `/*"]}]}`
-
-	// Create user, group, policy
-	_, err = iamClient.CreateUser(&iam.CreateUserInput{UserName: aws.String(userName)})
-	require.NoError(t, err)
-
-	keyResp, err := iamClient.CreateAccessKey(&iam.CreateAccessKeyInput{UserName: aws.String(userName)})
-	require.NoError(t, err)
-
-	_, err = iamClient.CreateGroup(&iam.CreateGroupInput{GroupName: aws.String(groupName)})
-	require.NoError(t, err)
-
-	createPolicyResp, err := iamClient.CreatePolicy(&iam.CreatePolicyInput{
-		PolicyName: aws.String(policyName), PolicyDocument: aws.String(policyDoc),
-	})
-	require.NoError(t, err)
-
-	// Cleanup in correct order: remove user from group, detach policy,
-	// delete access key, delete user, delete group, delete policy
-	t.Cleanup(func() {
-		if _, err := iamClient.RemoveUserFromGroup(&iam.RemoveUserFromGroupInput{
-			GroupName: aws.String(groupName), UserName: aws.String(userName),
-		}); err != nil {
-			t.Logf("cleanup: failed to remove user from group: %v", err)
-		}
-		if _, err := iamClient.DetachGroupPolicy(&iam.DetachGroupPolicyInput{
-			GroupName: aws.String(groupName),
-			PolicyArn: aws.String("arn:aws:iam:::policy/" + policyName),
-		}); err != nil {
-			t.Logf("cleanup: failed to detach group policy: %v", err)
-		}
-		if _, err := iamClient.DeleteAccessKey(&iam.DeleteAccessKeyInput{
-			UserName: aws.String(userName), AccessKeyId: keyResp.AccessKey.AccessKeyId,
-		}); err != nil {
-			t.Logf("cleanup: failed to delete access key: %v", err)
-		}
-		if _, err := iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)}); err != nil {
-			t.Logf("cleanup: failed to delete user: %v", err)
-		}
-		if _, err := iamClient.DeleteGroup(&iam.DeleteGroupInput{GroupName: aws.String(groupName)}); err != nil {
-			t.Logf("cleanup: failed to delete group: %v", err)
-		}
-		if _, err := iamClient.DeletePolicy(&iam.DeletePolicyInput{PolicyArn: createPolicyResp.Policy.Arn}); err != nil {
-			t.Logf("cleanup: failed to delete policy: %v", err)
-		}
-	})
-
-	// Setup: attach policy, add user, create bucket with admin
-	_, err = iamClient.AttachGroupPolicy(&iam.AttachGroupPolicyInput{
-		GroupName: aws.String(groupName), PolicyArn: createPolicyResp.Policy.Arn,
-	})
-	require.NoError(t, err)
-
-	_, err = iamClient.AddUserToGroup(&iam.AddUserToGroupInput{
-		GroupName: aws.String(groupName), UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-
-	userS3Client := createS3Client(t, *keyResp.AccessKey.AccessKeyId, *keyResp.AccessKey.SecretAccessKey)
-
-	// Create bucket using admin first so we can test listing
-	adminS3, err := framework.CreateS3ClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-	_, err = adminS3.CreateBucket(&s3.CreateBucketInput{Bucket: aws.String(bucketName)})
-	require.NoError(t, err)
-	defer adminS3.DeleteBucket(&s3.DeleteBucketInput{Bucket: aws.String(bucketName)})
-
-	t.Run("enabled_group_allows_access", func(t *testing.T) {
-		require.Eventually(t, func() bool {
-			_, err := userS3Client.ListObjects(&s3.ListObjectsInput{
-				Bucket: aws.String(bucketName),
-			})
-			return err == nil
-		}, 10*time.Second, 500*time.Millisecond, "User in enabled group should have access")
-	})
-
-	t.Run("disabled_group_denies_access", func(t *testing.T) {
-		// Disable group via raw IAM API (no SDK support for this extension)
-		resp, err := callIAMAPIAuthenticated(t, framework, "UpdateGroup", url.Values{
-			"GroupName": {groupName},
-			"Disabled":  {"true"},
-		})
-		require.NoError(t, err)
-		defer resp.Body.Close()
-		require.Equal(t, http.StatusOK, resp.StatusCode, "UpdateGroup (disable) should return 200")
-
-		// Wait for propagation — user should be denied
-		var lastErr error
-		require.Eventually(t, func() bool {
-			_, lastErr = userS3Client.ListObjects(&s3.ListObjectsInput{
-				Bucket: aws.String(bucketName),
-			})
-			return lastErr != nil
-		}, 10*time.Second, 500*time.Millisecond, "User in disabled group should be denied access")
-		awsErr, ok := lastErr.(awserr.Error)
-		require.True(t, ok, "Expected awserr.Error")
-		assert.Equal(t, "AccessDenied", awsErr.Code())
-	})
-
-	t.Run("re_enabled_group_restores_access", func(t *testing.T) {
-		// Re-enable the group
-		resp, err := callIAMAPIAuthenticated(t, framework, "UpdateGroup", url.Values{
-			"GroupName": {groupName},
-			"Disabled":  {"false"},
-		})
-		require.NoError(t, err)
-		defer resp.Body.Close()
-		require.Equal(t, http.StatusOK, resp.StatusCode, "UpdateGroup (re-enable) should return 200")
-
-		// Wait for propagation — user should have access again
-		require.Eventually(t, func() bool {
-			_, err = userS3Client.ListObjects(&s3.ListObjectsInput{
-				Bucket: aws.String(bucketName),
-			})
-			return err == nil
-		}, 10*time.Second, 500*time.Millisecond, "User in re-enabled group should have access again")
-	})
-}
-
-// TestIAMGroupUserDeletionSideEffect tests that deleting a user removes them from all groups.
-func TestIAMGroupUserDeletionSideEffect(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	groupName := "test-deletion-group"
-	userName := "test-deletion-user"
-
-	// Create group and user
-	_, err = iamClient.CreateGroup(&iam.CreateGroupInput{GroupName: aws.String(groupName)})
-	require.NoError(t, err)
-	defer iamClient.DeleteGroup(&iam.DeleteGroupInput{GroupName: aws.String(groupName)})
-
-	_, err = iamClient.CreateUser(&iam.CreateUserInput{UserName: aws.String(userName)})
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		// Best-effort: user may already be deleted by the test
-		iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)})
-	})
-
-	// Add user to group
-	_, err = iamClient.AddUserToGroup(&iam.AddUserToGroupInput{
-		GroupName: aws.String(groupName),
-		UserName:  aws.String(userName),
-	})
-	require.NoError(t, err)
-
-	// Verify user is in group
-	getResp, err := iamClient.GetGroup(&iam.GetGroupInput{GroupName: aws.String(groupName)})
-	require.NoError(t, err)
-	assert.Len(t, getResp.Users, 1, "Group should have 1 member before deletion")
-
-	// Delete the user
-	_, err = iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)})
-	require.NoError(t, err)
-
-	// Verify user was removed from the group
-	getResp, err = iamClient.GetGroup(&iam.GetGroupInput{GroupName: aws.String(groupName)})
-	require.NoError(t, err)
-	assert.Empty(t, getResp.Users, "Group should have no members after user deletion")
-}
-
-// TestIAMGroupMultipleGroups tests that a user can belong to multiple groups
-// and inherits policies from all of them.
-func TestIAMGroupMultipleGroups(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	group1 := "test-multi-group-1"
-	group2 := "test-multi-group-2"
-	userName := "test-multi-group-user"
-
-	// Create two groups
-	_, err = iamClient.CreateGroup(&iam.CreateGroupInput{GroupName: aws.String(group1)})
-	require.NoError(t, err)
-	defer iamClient.DeleteGroup(&iam.DeleteGroupInput{GroupName: aws.String(group1)})
-
-	_, err = iamClient.CreateGroup(&iam.CreateGroupInput{GroupName: aws.String(group2)})
-	require.NoError(t, err)
-	defer iamClient.DeleteGroup(&iam.DeleteGroupInput{GroupName: aws.String(group2)})
-
-	// Create user
-	_, err = iamClient.CreateUser(&iam.CreateUserInput{UserName: aws.String(userName)})
-	require.NoError(t, err)
-	defer func() {
-		iamClient.RemoveUserFromGroup(&iam.RemoveUserFromGroupInput{
-			GroupName: aws.String(group1), UserName: aws.String(userName),
-		})
-		iamClient.RemoveUserFromGroup(&iam.RemoveUserFromGroupInput{
-			GroupName: aws.String(group2), UserName: aws.String(userName),
-		})
-		iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)})
-	}()
-
-	// Add user to both groups
-	_, err = iamClient.AddUserToGroup(&iam.AddUserToGroupInput{
-		GroupName: aws.String(group1), UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-
-	_, err = iamClient.AddUserToGroup(&iam.AddUserToGroupInput{
-		GroupName: aws.String(group2), UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-
-	// Verify user appears in both groups
-	resp, err := iamClient.ListGroupsForUser(&iam.ListGroupsForUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-	groupNames := make(map[string]bool)
-	for _, g := range resp.Groups {
-		groupNames[*g.GroupName] = true
-	}
-	assert.True(t, groupNames[group1], "User should be in group 1")
-	assert.True(t, groupNames[group2], "User should be in group 2")
-}
-
-// --- Response types for raw IAM API calls ---
-
-type CreateGroupResponse struct {
-	XMLName           xml.Name `xml:"CreateGroupResponse"`
-	CreateGroupResult struct {
-		Group struct {
-			GroupName string `xml:"GroupName"`
-		} `xml:"Group"`
-	} `xml:"CreateGroupResult"`
-}
-
-type ListGroupsResponse struct {
-	XMLName          xml.Name `xml:"ListGroupsResponse"`
-	ListGroupsResult struct {
-		Groups []struct {
-			GroupName string `xml:"GroupName"`
-		} `xml:"Groups>member"`
-	} `xml:"ListGroupsResult"`
-}
-
-// callIAMAPIAuthenticated sends an authenticated raw IAM API request using the
-// framework's JWT token. This is needed for custom extensions not in the AWS SDK
-// (like UpdateGroup with Disabled parameter).
-func callIAMAPIAuthenticated(_ *testing.T, framework *S3IAMTestFramework, action string, params url.Values) (*http.Response, error) {
-	params.Set("Action", action)
-
-	req, err := http.NewRequest(http.MethodPost, TestIAMEndpoint+"/",
-		strings.NewReader(params.Encode()))
-	if err != nil {
-		return nil, err
-	}
-
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	token, err := framework.generateSTSSessionToken("admin-user", "TestAdminRole", time.Hour, "", nil)
-	if err != nil {
-		return nil, err
-	}
-
-	client := &http.Client{
-		Timeout:   30 * time.Second,
-		Transport: &BearerTokenTransport{Token: token},
-	}
-	return client.Do(req)
-}
-
-// TestIAMGroupRawAPI tests group operations using raw HTTP IAM API calls,
-// verifying XML response format for group operations.
-func TestIAMGroupRawAPI(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	if !isSeaweedFSRunning(t) {
-		t.Skip("SeaweedFS is not running at", TestIAMEndpoint)
-	}
-
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	groupName := "test-raw-api-group"
-
-	t.Run("create_group_raw", func(t *testing.T) {
-		resp, err := callIAMAPIAuthenticated(t, framework, "CreateGroup", url.Values{
-			"GroupName": {groupName},
-		})
-		require.NoError(t, err)
-		defer resp.Body.Close()
-		assert.Equal(t, http.StatusOK, resp.StatusCode)
-
-		body, err := io.ReadAll(resp.Body)
-		require.NoError(t, err)
-
-		var createResp CreateGroupResponse
-		err = xml.Unmarshal(body, &createResp)
-		require.NoError(t, err)
-		assert.Equal(t, groupName, createResp.CreateGroupResult.Group.GroupName)
-	})
-
-	t.Run("list_groups_raw", func(t *testing.T) {
-		resp, err := callIAMAPIAuthenticated(t, framework, "ListGroups", url.Values{})
-		require.NoError(t, err)
-		defer resp.Body.Close()
-		assert.Equal(t, http.StatusOK, resp.StatusCode)
-
-		body, err := io.ReadAll(resp.Body)
-		require.NoError(t, err)
-
-		var listResp ListGroupsResponse
-		err = xml.Unmarshal(body, &listResp)
-		require.NoError(t, err)
-
-		found := false
-		for _, g := range listResp.ListGroupsResult.Groups {
-			if g.GroupName == groupName {
-				found = true
-				break
-			}
-		}
-		assert.True(t, found, "Created group should appear in raw ListGroups")
-	})
-
-	t.Run("delete_group_raw", func(t *testing.T) {
-		resp, err := callIAMAPIAuthenticated(t, framework, "DeleteGroup", url.Values{
-			"GroupName": {groupName},
-		})
-		require.NoError(t, err)
-		defer resp.Body.Close()
-		assert.Equal(t, http.StatusOK, resp.StatusCode)
-	})
-}
-
-// createS3Client creates an S3 client with static credentials
-func createS3Client(t *testing.T, accessKey, secretKey string) *s3.S3 {
-	sess, err := session.NewSession(&aws.Config{
-		Region:           aws.String("us-east-1"),
-		Endpoint:         aws.String(TestS3Endpoint),
-		Credentials:      credentials.NewStaticCredentials(accessKey, secretKey, ""),
-		DisableSSL:       aws.Bool(true),
-		S3ForcePathStyle: aws.Bool(true),
-	})
-	require.NoError(t, err)
-	return s3.New(sess)
-}

weed/admin/dash/admin_data.go

@@ -80,11 +80,6 @@ type AccessKeyInfo struct {
 	CreatedAt time.Time `json:"created_at"`
 }
 
-type CreateAccessKeyRequest struct {
-	AccessKey string `json:"access_key"`
-	SecretKey string `json:"secret_key"`
-}
-
 type UpdateAccessKeyStatusRequest struct {
 	Status string `json:"status" binding:"required"`
 }
@@ -95,7 +90,6 @@ type UserDetails struct {
 	Actions     []string        `json:"actions"`
 	PolicyNames []string        `json:"policy_names"`
 	AccessKeys  []AccessKeyInfo `json:"access_keys"`
-	Groups      []string        `json:"groups"`
 }
 
 type FilerNode struct {

weed/admin/dash/admin_server.go

@@ -2,9 +2,7 @@ package dash
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"io"
 	"net/http"
 	"sort"
 	"strings"
@@ -373,21 +371,8 @@ func (s *AdminServer) GetCredentialManager() *credential.CredentialManager {
 
 // InvalidateCache method moved to cluster_topology.go
 
-// GetS3BucketsData retrieves Object Store buckets with pagination and sorting
-func (s *AdminServer) GetS3BucketsData(page, pageSize int, sortBy, sortOrder string) (S3BucketsData, error) {
-	if page < 1 {
-		page = 1
-	}
-	if pageSize < 1 || pageSize > 1000 {
-		pageSize = 100
-	}
-	if sortBy == "" {
-		sortBy = "name"
-	}
-	if sortOrder == "" {
-		sortOrder = "asc"
-	}
-
+// GetS3BucketsData retrieves all Object Store buckets and aggregates total storage metrics
+func (s *AdminServer) GetS3BucketsData() (S3BucketsData, error) {
 	buckets, err := s.GetS3Buckets()
 	if err != nil {
 		return S3BucketsData{}, err
@@ -398,97 +383,14 @@ func (s *AdminServer) GetS3BucketsData(page, pageSize int, sortBy, sortOrder str
 		totalSize += bucket.PhysicalSize
 	}
 
-	totalBuckets := len(buckets)
-
-	// Sort buckets
-	s.sortBuckets(buckets, sortBy, sortOrder)
-
-	// Calculate pagination
-	totalPages := (totalBuckets + pageSize - 1) / pageSize
-	if totalPages == 0 {
-		totalPages = 1
-	}
-	if page > totalPages {
-		page = totalPages
-	}
-
-	startIndex := (page - 1) * pageSize
-	endIndex := startIndex + pageSize
-	if startIndex >= totalBuckets {
-		buckets = []S3Bucket{}
-	} else {
-		if endIndex > totalBuckets {
-			endIndex = totalBuckets
-		}
-		buckets = buckets[startIndex:endIndex]
-	}
-
 	return S3BucketsData{
 		Buckets:      buckets,
-		TotalBuckets: totalBuckets,
+		TotalBuckets: len(buckets),
 		TotalSize:    totalSize,
 		LastUpdated:  time.Now(),
-		CurrentPage:  page,
-		TotalPages:   totalPages,
-		PageSize:     pageSize,
-		SortBy:       sortBy,
-		SortOrder:    sortOrder,
 	}, nil
 }
 
-// sortBuckets sorts the bucket slice in place by the given field and order
-func (s *AdminServer) sortBuckets(buckets []S3Bucket, sortBy, sortOrder string) {
-	desc := sortOrder == "desc"
-	sort.Slice(buckets, func(i, j int) bool {
-		a, b := buckets[i], buckets[j]
-		switch sortBy {
-		case "owner":
-			if a.Owner != b.Owner {
-				if desc {
-					return a.Owner > b.Owner
-				}
-				return a.Owner < b.Owner
-			}
-		case "created":
-			if !a.CreatedAt.Equal(b.CreatedAt) {
-				if desc {
-					return a.CreatedAt.After(b.CreatedAt)
-				}
-				return a.CreatedAt.Before(b.CreatedAt)
-			}
-		case "objects":
-			if a.ObjectCount != b.ObjectCount {
-				if desc {
-					return a.ObjectCount > b.ObjectCount
-				}
-				return a.ObjectCount < b.ObjectCount
-			}
-		case "logical_size":
-			if a.LogicalSize != b.LogicalSize {
-				if desc {
-					return a.LogicalSize > b.LogicalSize
-				}
-				return a.LogicalSize < b.LogicalSize
-			}
-		case "physical_size":
-			if a.PhysicalSize != b.PhysicalSize {
-				if desc {
-					return a.PhysicalSize > b.PhysicalSize
-				}
-				return a.PhysicalSize < b.PhysicalSize
-			}
-		}
-		// Tie-breaker: sort by name (also the default/primary for sortBy=="name")
-		if a.Name != b.Name {
-			if desc {
-				return a.Name > b.Name
-			}
-			return a.Name < b.Name
-		}
-		return false
-	})
-}
-
 // GetS3Buckets retrieves all Object Store buckets from the filer and collects size/object data from collections
 func (s *AdminServer) GetS3Buckets() ([]S3Bucket, error) {
 	var buckets []S3Bucket
@@ -504,48 +406,28 @@ func (s *AdminServer) GetS3Buckets() ([]S3Bucket, error) {
 
 	// Now list buckets from the filer and match with collection data
 	err = s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		// Paginate through all buckets in the buckets directory
-		const listPageSize = 1000
-		startFrom := ""
-		var snapshotTsNs int64
+		// List buckets by looking at the buckets directory
+		stream, err := client.ListEntries(context.Background(), &filer_pb.ListEntriesRequest{
+			Directory:          filerConfig.BucketsPath,
+			Prefix:             "",
+			StartFromFileName:  "",
+			InclusiveStartFrom: false,
+			Limit:              1000,
+		})
+		if err != nil {
+			return err
+		}
+
 		for {
-			stream, err := client.ListEntries(context.Background(), &filer_pb.ListEntriesRequest{
-				Directory:          filerConfig.BucketsPath,
-				Prefix:             "",
-				StartFromFileName:  startFrom,
-				InclusiveStartFrom: false,
-				Limit:              listPageSize,
-				SnapshotTsNs:       snapshotTsNs,
-			})
+			resp, err := stream.Recv()
 			if err != nil {
+				if err.Error() == "EOF" {
+					break
+				}
 				return err
 			}
 
-			pageCount := 0
-			lastName := ""
-			for {
-				resp, err := stream.Recv()
-				if err != nil {
-					if errors.Is(err, io.EOF) {
-						break
-					}
-					return err
-				}
-
-				if snapshotTsNs == 0 && resp.SnapshotTsNs != 0 {
-					snapshotTsNs = resp.SnapshotTsNs
-				}
-
-				if resp.Entry == nil {
-					continue
-				}
-				lastName = resp.Entry.Name
-				pageCount++
-
-				if !resp.Entry.IsDirectory {
-					continue
-				}
-
+			if resp.Entry != nil && resp.Entry.IsDirectory {
 				bucketName := resp.Entry.Name
 				if strings.HasPrefix(bucketName, ".") {
 					// Skip internal/system directories from Object Store bucket listing.
@@ -620,12 +502,6 @@ func (s *AdminServer) GetS3Buckets() ([]S3Bucket, error) {
 				}
 				buckets = append(buckets, bucket)
 			}
-
-			// If we received fewer entries than the page size, we've listed everything
-			if pageCount < listPageSize {
-				break
-			}
-			startFrom = lastName
 		}
 
 		return nil

weed/admin/dash/bucket_management.go

@@ -26,15 +26,6 @@ type S3BucketsData struct {
 	TotalBuckets int        `json:"total_buckets"`
 	TotalSize    int64      `json:"total_size"`
 	LastUpdated  time.Time  `json:"last_updated"`
-
-	// Pagination
-	CurrentPage int `json:"current_page"`
-	TotalPages  int `json:"total_pages"`
-	PageSize    int `json:"page_size"`
-
-	// Sorting
-	SortBy    string `json:"sort_by"`
-	SortOrder string `json:"sort_order"`
 }
 
 type CreateBucketRequest struct {
@@ -57,7 +48,7 @@ type CreateBucketRequest struct {
 func (s *AdminServer) ShowS3Buckets(w http.ResponseWriter, r *http.Request) {
 	username := UsernameFromContext(r.Context())
 
-	data, err := s.GetS3BucketsData(1, 100, "name", "asc")
+	data, err := s.GetS3BucketsData()
 	if err != nil {
 		writeJSONError(w, http.StatusInternalServerError, "Failed to get Object Store buckets: "+err.Error())
 		return

weed/admin/dash/group_management.go

@@ -1,250 +0,0 @@
-package dash
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	"github.com/seaweedfs/seaweedfs/weed/credential"
-	"github.com/seaweedfs/seaweedfs/weed/glog"
-	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
-)
-
-// cloneGroup creates a deep copy of an iam_pb.Group to avoid mutating stored state.
-func cloneGroup(g *iam_pb.Group) *iam_pb.Group {
-	clone := &iam_pb.Group{
-		Name:     g.Name,
-		Disabled: g.Disabled,
-	}
-	if g.Members != nil {
-		clone.Members = make([]string, len(g.Members))
-		copy(clone.Members, g.Members)
-	}
-	if g.PolicyNames != nil {
-		clone.PolicyNames = make([]string, len(g.PolicyNames))
-		copy(clone.PolicyNames, g.PolicyNames)
-	}
-	return clone
-}
-
-func (s *AdminServer) GetGroups(ctx context.Context) ([]GroupData, error) {
-	if s.credentialManager == nil {
-		return nil, fmt.Errorf("credential manager not available")
-	}
-
-	groupNames, err := s.credentialManager.ListGroups(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("failed to list groups: %w", err)
-	}
-
-	var groups []GroupData
-	for _, name := range groupNames {
-		g, err := s.credentialManager.GetGroup(ctx, name)
-		if err != nil {
-			if errors.Is(err, credential.ErrGroupNotFound) {
-				glog.V(1).Infof("Group %s listed but not found, skipping", name)
-				continue
-			}
-			return nil, fmt.Errorf("failed to get group %s: %w", name, err)
-		}
-		status := "enabled"
-		if g.Disabled {
-			status = "disabled"
-		}
-		groups = append(groups, GroupData{
-			Name:        g.Name,
-			MemberCount: len(g.Members),
-			PolicyCount: len(g.PolicyNames),
-			Status:      status,
-			Members:     g.Members,
-			PolicyNames: g.PolicyNames,
-		})
-	}
-	return groups, nil
-}
-
-func (s *AdminServer) GetGroupDetails(ctx context.Context, name string) (*GroupData, error) {
-	if s.credentialManager == nil {
-		return nil, fmt.Errorf("credential manager not available")
-	}
-
-	g, err := s.credentialManager.GetGroup(ctx, name)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get group: %w", err)
-	}
-	status := "enabled"
-	if g.Disabled {
-		status = "disabled"
-	}
-	return &GroupData{
-		Name:        g.Name,
-		MemberCount: len(g.Members),
-		PolicyCount: len(g.PolicyNames),
-		Status:      status,
-		Members:     g.Members,
-		PolicyNames: g.PolicyNames,
-	}, nil
-}
-
-func (s *AdminServer) CreateGroup(ctx context.Context, name string) (*GroupData, error) {
-	if s.credentialManager == nil {
-		return nil, fmt.Errorf("credential manager not available")
-	}
-
-	group := &iam_pb.Group{Name: name}
-	if err := s.credentialManager.CreateGroup(ctx, group); err != nil {
-		return nil, fmt.Errorf("failed to create group: %w", err)
-	}
-	glog.V(1).Infof("Created group %s", group.Name)
-	return &GroupData{
-		Name:   group.Name,
-		Status: "enabled",
-	}, nil
-}
-
-func (s *AdminServer) DeleteGroup(ctx context.Context, name string) error {
-	if s.credentialManager == nil {
-		return fmt.Errorf("credential manager not available")
-	}
-	// Check for members and attached policies before deleting (same guards as IAM handlers)
-	g, err := s.credentialManager.GetGroup(ctx, name)
-	if err != nil {
-		return fmt.Errorf("failed to get group: %w", err)
-	}
-	if len(g.Members) > 0 {
-		return fmt.Errorf("cannot delete group %s: group has %d member(s): %w", name, len(g.Members), credential.ErrGroupNotEmpty)
-	}
-	if len(g.PolicyNames) > 0 {
-		return fmt.Errorf("cannot delete group %s: group has %d attached policy(ies): %w", name, len(g.PolicyNames), credential.ErrGroupNotEmpty)
-	}
-	if err := s.credentialManager.DeleteGroup(ctx, name); err != nil {
-		return fmt.Errorf("failed to delete group: %w", err)
-	}
-	glog.V(1).Infof("Deleted group %s", name)
-	return nil
-}
-
-func (s *AdminServer) AddGroupMember(ctx context.Context, groupName, username string) error {
-	if s.credentialManager == nil {
-		return fmt.Errorf("credential manager not available")
-	}
-	g, err := s.credentialManager.GetGroup(ctx, groupName)
-	if err != nil {
-		return fmt.Errorf("failed to get group: %w", err)
-	}
-	g = cloneGroup(g)
-	if _, err := s.credentialManager.GetUser(ctx, username); err != nil {
-		return fmt.Errorf("user %s not found: %w", username, err)
-	}
-	for _, m := range g.Members {
-		if m == username {
-			return nil // already a member
-		}
-	}
-	g.Members = append(g.Members, username)
-	if err := s.credentialManager.UpdateGroup(ctx, g); err != nil {
-		return fmt.Errorf("failed to update group: %w", err)
-	}
-	glog.V(1).Infof("Added user %s to group %s", username, groupName)
-	return nil
-}
-
-func (s *AdminServer) RemoveGroupMember(ctx context.Context, groupName, username string) error {
-	if s.credentialManager == nil {
-		return fmt.Errorf("credential manager not available")
-	}
-	g, err := s.credentialManager.GetGroup(ctx, groupName)
-	if err != nil {
-		return fmt.Errorf("failed to get group: %w", err)
-	}
-	g = cloneGroup(g)
-	found := false
-	var newMembers []string
-	for _, m := range g.Members {
-		if m == username {
-			found = true
-		} else {
-			newMembers = append(newMembers, m)
-		}
-	}
-	if !found {
-		return fmt.Errorf("user %s is not a member of group %s: %w", username, groupName, credential.ErrUserNotInGroup)
-	}
-	g.Members = newMembers
-	if err := s.credentialManager.UpdateGroup(ctx, g); err != nil {
-		return fmt.Errorf("failed to update group: %w", err)
-	}
-	glog.V(1).Infof("Removed user %s from group %s", username, groupName)
-	return nil
-}
-
-func (s *AdminServer) AttachGroupPolicy(ctx context.Context, groupName, policyName string) error {
-	if s.credentialManager == nil {
-		return fmt.Errorf("credential manager not available")
-	}
-	g, err := s.credentialManager.GetGroup(ctx, groupName)
-	if err != nil {
-		return fmt.Errorf("failed to get group: %w", err)
-	}
-	g = cloneGroup(g)
-	if _, err := s.credentialManager.GetPolicy(ctx, policyName); err != nil {
-		return fmt.Errorf("policy %s not found: %w", policyName, err)
-	}
-	for _, p := range g.PolicyNames {
-		if p == policyName {
-			return nil // already attached
-		}
-	}
-	g.PolicyNames = append(g.PolicyNames, policyName)
-	if err := s.credentialManager.UpdateGroup(ctx, g); err != nil {
-		return fmt.Errorf("failed to update group: %w", err)
-	}
-	glog.V(1).Infof("Attached policy %s to group %s", policyName, groupName)
-	return nil
-}
-
-func (s *AdminServer) DetachGroupPolicy(ctx context.Context, groupName, policyName string) error {
-	if s.credentialManager == nil {
-		return fmt.Errorf("credential manager not available")
-	}
-	g, err := s.credentialManager.GetGroup(ctx, groupName)
-	if err != nil {
-		return fmt.Errorf("failed to get group: %w", err)
-	}
-	g = cloneGroup(g)
-	found := false
-	var newPolicies []string
-	for _, p := range g.PolicyNames {
-		if p == policyName {
-			found = true
-		} else {
-			newPolicies = append(newPolicies, p)
-		}
-	}
-	if !found {
-		return fmt.Errorf("policy %s is not attached to group %s: %w", policyName, groupName, credential.ErrPolicyNotAttached)
-	}
-	g.PolicyNames = newPolicies
-	if err := s.credentialManager.UpdateGroup(ctx, g); err != nil {
-		return fmt.Errorf("failed to update group: %w", err)
-	}
-	glog.V(1).Infof("Detached policy %s from group %s", policyName, groupName)
-	return nil
-}
-
-func (s *AdminServer) SetGroupStatus(ctx context.Context, groupName string, enabled bool) error {
-	if s.credentialManager == nil {
-		return fmt.Errorf("credential manager not available")
-	}
-	g, err := s.credentialManager.GetGroup(ctx, groupName)
-	if err != nil {
-		return fmt.Errorf("failed to get group: %w", err)
-	}
-	g = cloneGroup(g)
-	g.Disabled = !enabled
-	if err := s.credentialManager.UpdateGroup(ctx, g); err != nil {
-		return fmt.Errorf("failed to update group: %w", err)
-	}
-	glog.V(1).Infof("Set group %s status to enabled=%v", groupName, enabled)
-	return nil
-}

weed/admin/dash/plugin_api.go

@@ -235,6 +235,53 @@ func (s *AdminServer) GetPluginSchedulerStatusAPI(w http.ResponseWriter, r *http
 	writeJSON(w, http.StatusOK, response)
 }
 
+// GetPluginSchedulerConfigAPI returns scheduler configuration.
+func (s *AdminServer) GetPluginSchedulerConfigAPI(w http.ResponseWriter, r *http.Request) {
+	pluginSvc := s.GetPlugin()
+	if pluginSvc == nil {
+		writeJSONError(w, http.StatusNotFound, "plugin is not enabled")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, pluginSvc.GetSchedulerConfig())
+}
+
+// UpdatePluginSchedulerConfigAPI updates scheduler configuration.
+func (s *AdminServer) UpdatePluginSchedulerConfigAPI(w http.ResponseWriter, r *http.Request) {
+	pluginSvc := s.GetPlugin()
+	if pluginSvc == nil {
+		writeJSONError(w, http.StatusNotFound, "plugin is not enabled")
+		return
+	}
+
+	var req struct {
+		IdleSleepSeconds *int32 `json:"idle_sleep_seconds"`
+	}
+
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		if errors.Is(err, io.EOF) {
+			writeJSONError(w, http.StatusBadRequest, "request body is required")
+			return
+		}
+		writeJSONError(w, http.StatusBadRequest, "invalid request body: "+err.Error())
+		return
+	}
+	if req.IdleSleepSeconds == nil {
+		writeJSONError(w, http.StatusBadRequest, "idle_sleep_seconds is required")
+		return
+	}
+
+	updated, err := pluginSvc.UpdateSchedulerConfig(plugin.SchedulerConfig{
+		IdleSleepSeconds: *req.IdleSleepSeconds,
+	})
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, updated)
+}
+
 // RequestPluginJobTypeSchemaAPI asks a worker for one job type schema.
 func (s *AdminServer) RequestPluginJobTypeSchemaAPI(w http.ResponseWriter, r *http.Request) {
 	jobType := strings.TrimSpace(mux.Vars(r)["jobType"])

weed/admin/dash/types.go

@@ -589,30 +589,6 @@ type UpdateServiceAccountRequest struct {
 	Expiration  string `json:"expiration,omitempty"`
 }
 
-// Group management structures
-type GroupData struct {
-	Name        string   `json:"name"`
-	MemberCount int      `json:"member_count"`
-	PolicyCount int      `json:"policy_count"`
-	Status      string   `json:"status"` // "enabled" or "disabled"
-	Members     []string `json:"members"`
-	PolicyNames []string `json:"policy_names"`
-}
-
-type GroupsPageData struct {
-	Username          string      `json:"username"`
-	Groups            []GroupData `json:"groups"`
-	TotalGroups       int         `json:"total_groups"`
-	ActiveGroups      int         `json:"active_groups"`
-	AvailableUsers    []string    `json:"available_users"`
-	AvailablePolicies []string    `json:"available_policies"`
-	LastUpdated       time.Time   `json:"last_updated"`
-}
-
-type CreateGroupRequest struct {
-	Name string `json:"name"`
-}
-
 // STS Configuration display types
 type STSConfigData struct {
 	Enabled       bool      `json:"enabled"`

weed/admin/dash/user_management.go

@@ -4,21 +4,13 @@ import (
 	"context"
 	"crypto/rand"
 	"encoding/base64"
-	"errors"
 	"fmt"
-	"strings"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/credential"
 	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
 )
 
-var (
-	ErrAccessKeyInUse = errors.New("access key already in use")
-	ErrUserNotFound   = errors.New("user not found")
-	ErrInvalidInput   = errors.New("invalid input")
-)
-
 // CreateObjectStoreUser creates a new user using the credential manager
 func (s *AdminServer) CreateObjectStoreUser(req CreateUserRequest) (*ObjectStoreUser, error) {
 	if s.credentialManager == nil {
@@ -195,24 +187,6 @@ func (s *AdminServer) GetObjectStoreUserDetails(username string) (*UserDetails,
 		details.Email = identity.Account.EmailAddress
 	}
 
-	// Look up groups the user belongs to
-	groupNames, err := s.credentialManager.ListGroups(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("failed to list groups: %w", err)
-	}
-	for _, gName := range groupNames {
-		g, err := s.credentialManager.GetGroup(ctx, gName)
-		if err != nil {
-			return nil, fmt.Errorf("failed to get group %s: %w", gName, err)
-		}
-		for _, member := range g.Members {
-			if member == username {
-				details.Groups = append(details.Groups, gName)
-				break
-			}
-		}
-	}
-
 	// Convert credentials to access key info
 	for _, cred := range identity.Credentials {
 		details.AccessKeys = append(details.AccessKeys, AccessKeyInfo{
@@ -227,7 +201,7 @@ func (s *AdminServer) GetObjectStoreUserDetails(username string) (*UserDetails,
 }
 
 // CreateAccessKey creates a new access key for a user
-func (s *AdminServer) CreateAccessKey(username string, req *CreateAccessKeyRequest) (*AccessKeyInfo, error) {
+func (s *AdminServer) CreateAccessKey(username string) (*AccessKeyInfo, error) {
 	if s.credentialManager == nil {
 		return nil, fmt.Errorf("credential manager not available")
 	}
@@ -238,41 +212,14 @@ func (s *AdminServer) CreateAccessKey(username string, req *CreateAccessKeyReque
 	_, err := s.credentialManager.GetUser(ctx, username)
 	if err != nil {
 		if err == credential.ErrUserNotFound {
-			return nil, fmt.Errorf("user %s: %w", username, ErrUserNotFound)
+			return nil, fmt.Errorf("user %s not found", username)
 		}
 		return nil, fmt.Errorf("failed to get user: %w", err)
 	}
 
-	if req == nil {
-		req = &CreateAccessKeyRequest{}
-	}
-
-	// Validate provided keys
-	if req.AccessKey != "" && (len(req.AccessKey) < 4 || len(req.AccessKey) > 128) {
-		return nil, fmt.Errorf("access key must be between 4 and 128 characters: %w", ErrInvalidInput)
-	}
-	if req.SecretKey != "" && (len(req.SecretKey) < 8 || len(req.SecretKey) > 128) {
-		return nil, fmt.Errorf("secret key must be between 8 and 128 characters: %w", ErrInvalidInput)
-	}
-
-	// Use provided keys or generate new ones
-	accessKey := req.AccessKey
-	if accessKey == "" {
-		accessKey = generateAccessKey()
-	}
-	secretKey := req.SecretKey
-	if secretKey == "" {
-		secretKey = generateSecretKey()
-	}
-
-	// Verify access key is globally unique
-	existingUser, err := s.credentialManager.GetUserByAccessKey(ctx, accessKey)
-	if existingUser != nil {
-		return nil, ErrAccessKeyInUse
-	}
-	if err != nil && !errors.Is(err, credential.ErrAccessKeyNotFound) && !isNotFoundError(err) {
-		return nil, fmt.Errorf("failed to check access key uniqueness: %w", err)
-	}
+	// Generate new access key
+	accessKey := generateAccessKey()
+	secretKey := generateSecretKey()
 
 	credential := &iam_pb.Credential{
 		AccessKey: accessKey,
@@ -417,12 +364,6 @@ func (s *AdminServer) UpdateUserPolicies(username string, actions []string) erro
 	return nil
 }
 
-// isNotFoundError checks for "not found" in the error message as a fallback
-// for stores (e.g. gRPC) that don't return the credential.ErrAccessKeyNotFound sentinel.
-func isNotFoundError(err error) bool {
-	return err != nil && strings.Contains(strings.ToLower(err.Error()), "not found")
-}
-
 // Helper functions for generating keys and IDs
 func generateAccessKey() string {
 	// Generate 20-character access key (AWS standard)

weed/admin/dash/volume_management.go

@@ -457,7 +457,6 @@ func (s *AdminServer) GetClusterVolumeServers() (*ClusterVolumeServersData, erro
 
 						// Process disk information
 						for _, diskInfo := range node.DiskInfos {
-							vs.MaxVolumes += int(diskInfo.MaxVolumeCount)
 							vs.DiskCapacity += int64(diskInfo.MaxVolumeCount) * int64(volumeSizeLimitMB) * 1024 * 1024 // Use actual volume size limit
 
 							// Count regular volumes and calculate disk usage

weed/admin/handlers/admin_handlers.go

@@ -3,7 +3,6 @@ package handlers
 import (
 	"net/http"
 	"net/url"
-	"strconv"
 	"time"
 
 	"github.com/gorilla/mux"
@@ -29,7 +28,6 @@ type AdminHandlers struct {
 	pluginHandlers         *PluginHandlers
 	mqHandlers             *MessageQueueHandlers
 	serviceAccountHandlers *ServiceAccountHandlers
-	groupHandlers          *GroupHandlers
 }
 
 // NewAdminHandlers creates a new instance of AdminHandlers
@@ -42,7 +40,6 @@ func NewAdminHandlers(adminServer *dash.AdminServer, store sessions.Store) *Admi
 	pluginHandlers := NewPluginHandlers(adminServer)
 	mqHandlers := NewMessageQueueHandlers(adminServer)
 	serviceAccountHandlers := NewServiceAccountHandlers(adminServer)
-	groupHandlers := NewGroupHandlers(adminServer)
 	return &AdminHandlers{
 		adminServer:            adminServer,
 		sessionStore:           store,
@@ -54,7 +51,6 @@ func NewAdminHandlers(adminServer *dash.AdminServer, store sessions.Store) *Admi
 		pluginHandlers:         pluginHandlers,
 		mqHandlers:             mqHandlers,
 		serviceAccountHandlers: serviceAccountHandlers,
-		groupHandlers:          groupHandlers,
 	}
 }
 
@@ -108,7 +104,6 @@ func (h *AdminHandlers) registerUIRoutes(r *mux.Router) {
 	r.HandleFunc("/object-store/buckets/{bucket}", h.ShowBucketDetails).Methods(http.MethodGet)
 	r.HandleFunc("/object-store/users", h.userHandlers.ShowObjectStoreUsers).Methods(http.MethodGet)
 	r.HandleFunc("/object-store/policies", h.policyHandlers.ShowPolicies).Methods(http.MethodGet)
-	r.HandleFunc("/object-store/groups", h.groupHandlers.ShowGroups).Methods(http.MethodGet)
 	r.HandleFunc("/object-store/service-accounts", h.serviceAccountHandlers.ShowServiceAccounts).Methods(http.MethodGet)
 	r.HandleFunc("/object-store/s3tables/buckets", h.ShowS3TablesBuckets).Methods(http.MethodGet)
 	r.HandleFunc("/object-store/s3tables/buckets/{bucket}/namespaces", h.ShowS3TablesNamespaces).Methods(http.MethodGet)
@@ -190,19 +185,6 @@ func (h *AdminHandlers) registerAPIRoutes(api *mux.Router, enforceWrite bool) {
 	saApi.Handle("/{id}", wrapWrite(h.serviceAccountHandlers.UpdateServiceAccount)).Methods(http.MethodPut)
 	saApi.Handle("/{id}", wrapWrite(h.serviceAccountHandlers.DeleteServiceAccount)).Methods(http.MethodDelete)
 
-	groupsApi := api.PathPrefix("/groups").Subrouter()
-	groupsApi.HandleFunc("", h.groupHandlers.GetGroups).Methods(http.MethodGet)
-	groupsApi.Handle("", wrapWrite(h.groupHandlers.CreateGroup)).Methods(http.MethodPost)
-	groupsApi.HandleFunc("/{name}", h.groupHandlers.GetGroupDetails).Methods(http.MethodGet)
-	groupsApi.Handle("/{name}", wrapWrite(h.groupHandlers.DeleteGroup)).Methods(http.MethodDelete)
-	groupsApi.Handle("/{name}/status", wrapWrite(h.groupHandlers.SetGroupStatus)).Methods(http.MethodPut)
-	groupsApi.HandleFunc("/{name}/members", h.groupHandlers.GetGroupMembers).Methods(http.MethodGet)
-	groupsApi.Handle("/{name}/members", wrapWrite(h.groupHandlers.AddGroupMember)).Methods(http.MethodPost)
-	groupsApi.Handle("/{name}/members/{username}", wrapWrite(h.groupHandlers.RemoveGroupMember)).Methods(http.MethodDelete)
-	groupsApi.HandleFunc("/{name}/policies", h.groupHandlers.GetGroupPolicies).Methods(http.MethodGet)
-	groupsApi.Handle("/{name}/policies", wrapWrite(h.groupHandlers.AttachGroupPolicy)).Methods(http.MethodPost)
-	groupsApi.Handle("/{name}/policies/{policyName}", wrapWrite(h.groupHandlers.DetachGroupPolicy)).Methods(http.MethodDelete)
-
 	policyApi := api.PathPrefix("/object-store/policies").Subrouter()
 	policyApi.HandleFunc("", h.policyHandlers.GetPolicies).Methods(http.MethodGet)
 	policyApi.Handle("", wrapWrite(h.policyHandlers.CreatePolicy)).Methods(http.MethodPost)
@@ -247,6 +229,8 @@ func (h *AdminHandlers) registerAPIRoutes(api *mux.Router, enforceWrite bool) {
 	pluginApi.HandleFunc("/status", h.adminServer.GetPluginStatusAPI).Methods(http.MethodGet)
 	pluginApi.HandleFunc("/workers", h.adminServer.GetPluginWorkersAPI).Methods(http.MethodGet)
 	pluginApi.HandleFunc("/job-types", h.adminServer.GetPluginJobTypesAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/scheduler-config", h.adminServer.GetPluginSchedulerConfigAPI).Methods(http.MethodGet)
+	pluginApi.Handle("/scheduler-config", wrapWrite(h.adminServer.UpdatePluginSchedulerConfigAPI)).Methods(http.MethodPut)
 	pluginApi.HandleFunc("/jobs", h.adminServer.GetPluginJobsAPI).Methods(http.MethodGet)
 	pluginApi.HandleFunc("/jobs/{jobId}", h.adminServer.GetPluginJobAPI).Methods(http.MethodGet)
 	pluginApi.HandleFunc("/jobs/{jobId}/detail", h.adminServer.GetPluginJobDetailAPI).Methods(http.MethodGet)
@@ -294,26 +278,8 @@ func (h *AdminHandlers) ShowDashboard(w http.ResponseWriter, r *http.Request) {
 
 // ShowS3Buckets renders the Object Store buckets management page
 func (h *AdminHandlers) ShowS3Buckets(w http.ResponseWriter, r *http.Request) {
-	// Get pagination and sorting parameters from query string
-	page := 1
-	if p := r.URL.Query().Get("page"); p != "" {
-		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
-			page = parsed
-		}
-	}
-
-	pageSize := 100
-	if ps := r.URL.Query().Get("pageSize"); ps != "" {
-		if parsed, err := strconv.Atoi(ps); err == nil && parsed > 0 && parsed <= 1000 {
-			pageSize = parsed
-		}
-	}
-
-	sortBy := defaultQuery(r.URL.Query().Get("sortBy"), "name")
-	sortOrder := defaultQuery(r.URL.Query().Get("sortOrder"), "asc")
-
-	// Get Object Store buckets data with pagination
-	s3Data := h.getS3BucketsData(r, page, pageSize, sortBy, sortOrder)
+	// Get Object Store buckets data from the server
+	s3Data := h.getS3BucketsData(r)
 	username := h.getUsername(r)
 
 	// Render HTML template
@@ -480,15 +446,15 @@ func (h *AdminHandlers) ShowBucketDetails(w http.ResponseWriter, r *http.Request
 	writeJSON(w, http.StatusOK, details)
 }
 
-// getS3BucketsData retrieves Object Store buckets data from the server with pagination
-func (h *AdminHandlers) getS3BucketsData(r *http.Request, page, pageSize int, sortBy, sortOrder string) dash.S3BucketsData {
+// getS3BucketsData retrieves Object Store buckets data from the server
+func (h *AdminHandlers) getS3BucketsData(r *http.Request) dash.S3BucketsData {
 	username := dash.UsernameFromContext(r.Context())
 	if username == "" {
 		username = "admin"
 	}
 
 	// Get Object Store buckets data
-	data, err := h.adminServer.GetS3BucketsData(page, pageSize, sortBy, sortOrder)
+	data, err := h.adminServer.GetS3BucketsData()
 	if err != nil {
 		// Return empty data on error
 		return dash.S3BucketsData{
@@ -497,11 +463,6 @@ func (h *AdminHandlers) getS3BucketsData(r *http.Request, page, pageSize int, so
 			TotalBuckets: 0,
 			TotalSize:    0,
 			LastUpdated:  time.Now(),
-			CurrentPage:  1,
-			TotalPages:   1,
-			PageSize:     pageSize,
-			SortBy:       sortBy,
-			SortOrder:    sortOrder,
 		}
 	}
 

weed/admin/handlers/group_handlers.go

@@ -1,271 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"errors"
-	"net/http"
-	"time"
-
-	"github.com/gorilla/mux"
-	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
-	"github.com/seaweedfs/seaweedfs/weed/admin/view/app"
-	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
-	"github.com/seaweedfs/seaweedfs/weed/credential"
-	"github.com/seaweedfs/seaweedfs/weed/glog"
-)
-
-func groupErrorToHTTPStatus(err error) int {
-	if errors.Is(err, credential.ErrGroupNotFound) {
-		return http.StatusNotFound
-	}
-	if errors.Is(err, credential.ErrGroupAlreadyExists) {
-		return http.StatusConflict
-	}
-	if errors.Is(err, credential.ErrUserNotInGroup) {
-		return http.StatusBadRequest
-	}
-	if errors.Is(err, credential.ErrPolicyNotAttached) {
-		return http.StatusBadRequest
-	}
-	if errors.Is(err, credential.ErrUserNotFound) {
-		return http.StatusNotFound
-	}
-	if errors.Is(err, credential.ErrPolicyNotFound) {
-		return http.StatusNotFound
-	}
-	if errors.Is(err, credential.ErrGroupNotEmpty) {
-		return http.StatusConflict
-	}
-	return http.StatusInternalServerError
-}
-
-type GroupHandlers struct {
-	adminServer *dash.AdminServer
-}
-
-func NewGroupHandlers(adminServer *dash.AdminServer) *GroupHandlers {
-	return &GroupHandlers{adminServer: adminServer}
-}
-
-func (h *GroupHandlers) ShowGroups(w http.ResponseWriter, r *http.Request) {
-	data, err := h.getGroupsPageData(r)
-	if err != nil {
-		glog.Errorf("Failed to get groups data: %v", err)
-		writeJSONError(w, http.StatusInternalServerError, "Failed to load groups: "+err.Error())
-		return
-	}
-
-	var buf bytes.Buffer
-	component := app.Groups(data)
-	viewCtx := layout.NewViewContext(r, dash.UsernameFromContext(r.Context()), dash.CSRFTokenFromContext(r.Context()))
-	layoutComponent := layout.Layout(viewCtx, component)
-	if err := layoutComponent.Render(r.Context(), &buf); err != nil {
-		glog.Errorf("Failed to render groups template: %v", err)
-		w.WriteHeader(http.StatusInternalServerError)
-		return
-	}
-	w.Header().Set("Content-Type", "text/html")
-	_, _ = w.Write(buf.Bytes())
-}
-
-func (h *GroupHandlers) GetGroups(w http.ResponseWriter, r *http.Request) {
-	groups, err := h.adminServer.GetGroups(r.Context())
-	if err != nil {
-		glog.Errorf("Failed to get groups: %v", err)
-		writeJSONError(w, http.StatusInternalServerError, "Failed to get groups")
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]interface{}{"groups": groups})
-}
-
-func (h *GroupHandlers) CreateGroup(w http.ResponseWriter, r *http.Request) {
-	var req dash.CreateGroupRequest
-	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
-		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
-		return
-	}
-	if req.Name == "" {
-		writeJSONError(w, http.StatusBadRequest, "Group name is required")
-		return
-	}
-	group, err := h.adminServer.CreateGroup(r.Context(), req.Name)
-	if err != nil {
-		glog.Errorf("Failed to create group: %v", err)
-		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to create group: "+err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, group)
-}
-
-func (h *GroupHandlers) GetGroupDetails(w http.ResponseWriter, r *http.Request) {
-	name := mux.Vars(r)["name"]
-	group, err := h.adminServer.GetGroupDetails(r.Context(), name)
-	if err != nil {
-		glog.Errorf("Failed to get group details: %v", err)
-		status := groupErrorToHTTPStatus(err)
-		msg := "Failed to retrieve group"
-		if status == http.StatusNotFound {
-			msg = "Group not found"
-		}
-		writeJSONError(w, status, msg)
-		return
-	}
-	writeJSON(w, http.StatusOK, group)
-}
-
-func (h *GroupHandlers) DeleteGroup(w http.ResponseWriter, r *http.Request) {
-	name := mux.Vars(r)["name"]
-	if err := h.adminServer.DeleteGroup(r.Context(), name); err != nil {
-		glog.Errorf("Failed to delete group: %v", err)
-		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to delete group: "+err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]string{"message": "Group deleted successfully"})
-}
-
-func (h *GroupHandlers) GetGroupMembers(w http.ResponseWriter, r *http.Request) {
-	name := mux.Vars(r)["name"]
-	group, err := h.adminServer.GetGroupDetails(r.Context(), name)
-	if err != nil {
-		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to get group: "+err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]interface{}{"members": group.Members})
-}
-
-func (h *GroupHandlers) AddGroupMember(w http.ResponseWriter, r *http.Request) {
-	name := mux.Vars(r)["name"]
-	var req struct {
-		Username string `json:"username"`
-	}
-	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
-		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
-		return
-	}
-	if req.Username == "" {
-		writeJSONError(w, http.StatusBadRequest, "Username is required")
-		return
-	}
-	if err := h.adminServer.AddGroupMember(r.Context(), name, req.Username); err != nil {
-		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to add member: "+err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]string{"message": "Member added successfully"})
-}
-
-func (h *GroupHandlers) RemoveGroupMember(w http.ResponseWriter, r *http.Request) {
-	name := mux.Vars(r)["name"]
-	username := mux.Vars(r)["username"]
-	if err := h.adminServer.RemoveGroupMember(r.Context(), name, username); err != nil {
-		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to remove member: "+err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]string{"message": "Member removed successfully"})
-}
-
-func (h *GroupHandlers) GetGroupPolicies(w http.ResponseWriter, r *http.Request) {
-	name := mux.Vars(r)["name"]
-	group, err := h.adminServer.GetGroupDetails(r.Context(), name)
-	if err != nil {
-		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to get group: "+err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]interface{}{"policies": group.PolicyNames})
-}
-
-func (h *GroupHandlers) AttachGroupPolicy(w http.ResponseWriter, r *http.Request) {
-	name := mux.Vars(r)["name"]
-	var req struct {
-		PolicyName string `json:"policy_name"`
-	}
-	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
-		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
-		return
-	}
-	if req.PolicyName == "" {
-		writeJSONError(w, http.StatusBadRequest, "Policy name is required")
-		return
-	}
-	if err := h.adminServer.AttachGroupPolicy(r.Context(), name, req.PolicyName); err != nil {
-		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to attach policy: "+err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]string{"message": "Policy attached successfully"})
-}
-
-func (h *GroupHandlers) DetachGroupPolicy(w http.ResponseWriter, r *http.Request) {
-	name := mux.Vars(r)["name"]
-	policyName := mux.Vars(r)["policyName"]
-	if err := h.adminServer.DetachGroupPolicy(r.Context(), name, policyName); err != nil {
-		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to detach policy: "+err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]string{"message": "Policy detached successfully"})
-}
-
-func (h *GroupHandlers) SetGroupStatus(w http.ResponseWriter, r *http.Request) {
-	name := mux.Vars(r)["name"]
-	var req struct {
-		Enabled *bool `json:"enabled"`
-	}
-	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
-		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
-		return
-	}
-	if req.Enabled == nil {
-		writeJSONError(w, http.StatusBadRequest, "enabled field is required")
-		return
-	}
-	if err := h.adminServer.SetGroupStatus(r.Context(), name, *req.Enabled); err != nil {
-		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to update group status: "+err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]string{"message": "Group status updated"})
-}
-
-func (h *GroupHandlers) getGroupsPageData(r *http.Request) (dash.GroupsPageData, error) {
-	username := dash.UsernameFromContext(r.Context())
-	if username == "" {
-		username = "admin"
-	}
-
-	groups, err := h.adminServer.GetGroups(r.Context())
-	if err != nil {
-		return dash.GroupsPageData{}, err
-	}
-
-	activeCount := 0
-	for _, g := range groups {
-		if g.Status == "enabled" {
-			activeCount++
-		}
-	}
-
-	// Get available users for dropdown
-	var availableUsers []string
-	users, err := h.adminServer.GetObjectStoreUsers(r.Context())
-	if err == nil {
-		for _, user := range users {
-			availableUsers = append(availableUsers, user.Username)
-		}
-	}
-
-	// Get available policies for dropdown
-	var availablePolicies []string
-	policies, err := h.adminServer.GetPolicies()
-	if err == nil {
-		for _, p := range policies {
-			availablePolicies = append(availablePolicies, p.Name)
-		}
-	}
-
-	return dash.GroupsPageData{
-		Username:          username,
-		Groups:            groups,
-		TotalGroups:       len(groups),
-		ActiveGroups:      activeCount,
-		AvailableUsers:    availableUsers,
-		AvailablePolicies: availablePolicies,
-		LastUpdated:       time.Now(),
-	}, nil
-}

weed/admin/handlers/user_handlers.go

@@ -1,9 +1,7 @@
 package handlers
 
 import (
-	"errors"
 	"fmt"
-	"io"
 	"net/http"
 	"time"
 
@@ -157,30 +155,10 @@ func (h *UserHandlers) CreateAccessKey(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	var req *dash.CreateAccessKeyRequest
-	var body dash.CreateAccessKeyRequest
-	if err := decodeJSONBody(newJSONMaxReader(w, r), &body); err != nil {
-		if !errors.Is(err, io.EOF) {
-			writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
-			return
-		}
-		// Empty body: auto-generate both keys
-	} else {
-		req = &body
-	}
-
-	accessKey, err := h.adminServer.CreateAccessKey(username, req)
+	accessKey, err := h.adminServer.CreateAccessKey(username)
 	if err != nil {
 		glog.Errorf("Failed to create access key for user %s: %v", username, err)
-		if errors.Is(err, dash.ErrAccessKeyInUse) {
-			writeJSONError(w, http.StatusConflict, err.Error())
-		} else if errors.Is(err, dash.ErrUserNotFound) {
-			writeJSONError(w, http.StatusNotFound, err.Error())
-		} else if errors.Is(err, dash.ErrInvalidInput) {
-			writeJSONError(w, http.StatusBadRequest, err.Error())
-		} else {
-			writeJSONError(w, http.StatusInternalServerError, "Failed to create access key: "+err.Error())
-		}
+		writeJSONError(w, http.StatusInternalServerError, "Failed to create access key: "+err.Error())
 		return
 	}
 

weed/admin/maintenance/maintenance_manager.go

@@ -297,7 +297,7 @@ func (mm *MaintenanceManager) logTopologyStatus() {
 	errorCount := mm.errorCount
 	mm.mutex.RUnlock()
 
-	glog.V(1).Infof("Topology status: %d nodes, %d disks, %d workers, %d pending tasks, %d running tasks, errors: %d",
+	glog.V(0).Infof("Topology status: %d nodes, %d disks, %d workers, %d pending tasks, %d running tasks, errors: %d",
 		nodeCount, diskCount, workerCount,
 		stats.TasksByStatus[TaskStatusPending],
 		stats.TasksByStatus[TaskStatusInProgress]+stats.TasksByStatus[TaskStatusAssigned],

weed/admin/plugin/config_store.go

@@ -30,6 +30,7 @@ const (
 	runsJSONFileName        = "runs.json"
 	trackedJobsJSONFileName = "tracked_jobs.json"
 	activitiesJSONFileName  = "activities.json"
+	schedulerJSONFileName   = "scheduler.json"
 	defaultDirPerm          = 0o755
 	defaultFilePerm         = 0o644
 )
@@ -53,6 +54,7 @@ type ConfigStore struct {
 	memTrackedJobs []TrackedJob
 	memActivities  []JobActivity
 	memJobDetails  map[string]TrackedJob
+	memScheduler   *SchedulerConfig
 }
 
 func NewConfigStore(adminDataDir string) (*ConfigStore, error) {
@@ -93,6 +95,60 @@ func (s *ConfigStore) BaseDir() string {
 	return s.baseDir
 }
 
+func (s *ConfigStore) LoadSchedulerConfig() (*SchedulerConfig, error) {
+	s.mu.RLock()
+	if !s.configured {
+		cfg := s.memScheduler
+		s.mu.RUnlock()
+		if cfg == nil {
+			return nil, nil
+		}
+		clone := *cfg
+		return &clone, nil
+	}
+	s.mu.RUnlock()
+
+	path := filepath.Join(s.baseDir, schedulerJSONFileName)
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("read scheduler config: %w", err)
+	}
+
+	var cfg SchedulerConfig
+	if err := json.Unmarshal(data, &cfg); err != nil {
+		return nil, fmt.Errorf("unmarshal scheduler config: %w", err)
+	}
+	return &cfg, nil
+}
+
+func (s *ConfigStore) SaveSchedulerConfig(config *SchedulerConfig) error {
+	if config == nil {
+		return fmt.Errorf("scheduler config is nil")
+	}
+	normalized := normalizeSchedulerConfig(*config)
+
+	s.mu.Lock()
+	if !s.configured {
+		s.memScheduler = &normalized
+		s.mu.Unlock()
+		return nil
+	}
+	s.mu.Unlock()
+
+	payload, err := json.MarshalIndent(normalized, "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshal scheduler config: %w", err)
+	}
+	path := filepath.Join(s.baseDir, schedulerJSONFileName)
+	if err := os.WriteFile(path, payload, defaultFilePerm); err != nil {
+		return fmt.Errorf("save scheduler config: %w", err)
+	}
+	return nil
+}
+
 func (s *ConfigStore) SaveDescriptor(jobType string, descriptor *plugin_pb.JobTypeDescriptor) error {
 	if descriptor == nil {
 		return fmt.Errorf("descriptor is nil")

weed/admin/plugin/plugin.go

@@ -78,7 +78,9 @@ type Plugin struct {
 	schedulerRun              map[string]*schedulerRunInfo
 	schedulerLoopMu           sync.Mutex
 	schedulerLoopState        schedulerLoopState
-	schedulerWakeCh chan struct{}
+	schedulerConfigMu         sync.RWMutex
+	schedulerConfig           SchedulerConfig
+	schedulerWakeCh           chan struct{}
 
 	dedupeMu           sync.Mutex
 	recentDedupeByType map[string]map[string]time.Time
@@ -186,6 +188,21 @@ func New(options Options) (*Plugin, error) {
 	}
 	plugin.ctx, plugin.ctxCancel = context.WithCancel(context.Background())
 
+	if cfg, err := plugin.store.LoadSchedulerConfig(); err != nil {
+		glog.Warningf("Plugin failed to load scheduler config: %v", err)
+		plugin.schedulerConfig = DefaultSchedulerConfig()
+	} else if cfg == nil {
+		defaults := DefaultSchedulerConfig()
+		plugin.schedulerConfig = defaults
+		if plugin.store.IsConfigured() {
+			if err := plugin.store.SaveSchedulerConfig(&defaults); err != nil {
+				glog.Warningf("Plugin failed to persist scheduler defaults: %v", err)
+			}
+		}
+	} else {
+		plugin.schedulerConfig = normalizeSchedulerConfig(*cfg)
+	}
+
 	if err := plugin.loadPersistedMonitorState(); err != nil {
 		glog.Warningf("Plugin failed to load persisted monitoring state: %v", err)
 	}
@@ -409,6 +426,31 @@ func (r *Plugin) BaseDir() string {
 	return r.store.BaseDir()
 }
 
+func (r *Plugin) GetSchedulerConfig() SchedulerConfig {
+	if r == nil {
+		return DefaultSchedulerConfig()
+	}
+	r.schedulerConfigMu.RLock()
+	cfg := r.schedulerConfig
+	r.schedulerConfigMu.RUnlock()
+	return normalizeSchedulerConfig(cfg)
+}
+
+func (r *Plugin) UpdateSchedulerConfig(cfg SchedulerConfig) (SchedulerConfig, error) {
+	if r == nil {
+		return DefaultSchedulerConfig(), fmt.Errorf("plugin is not initialized")
+	}
+	normalized := normalizeSchedulerConfig(cfg)
+	if err := r.store.SaveSchedulerConfig(&normalized); err != nil {
+		return SchedulerConfig{}, err
+	}
+	r.schedulerConfigMu.Lock()
+	r.schedulerConfig = normalized
+	r.schedulerConfigMu.Unlock()
+	r.wakeScheduler()
+	return normalized, nil
+}
+
 func (r *Plugin) acquireAdminLock(reason string) (func(), error) {
 	if r == nil || r.lockManager == nil {
 		return func() {}, nil

weed/admin/plugin/plugin_scheduler.go

@@ -32,7 +32,6 @@ const (
 	defaultClusterContextTimeout               = 10 * time.Second
 	defaultWaitingBacklogFloor                 = 8
 	defaultWaitingBacklogMultiplier            = 4
-	maxEstimatedRuntimeCap                     = 8 * time.Hour
 )
 
 type schedulerPolicy struct {
@@ -65,7 +64,7 @@ func (r *Plugin) schedulerLoop() {
 		}
 
 		r.setSchedulerLoopState("", "sleeping")
-		idleSleep := defaultSchedulerIdleSleep
+		idleSleep := r.GetSchedulerConfig().IdleSleepDuration()
 		if nextRun := r.earliestNextDetectionAt(); !nextRun.IsZero() {
 			if until := time.Until(nextRun); until <= 0 {
 				idleSleep = 0
@@ -294,26 +293,6 @@ func (r *Plugin) runJobTypeIteration(jobType string, policy schedulerPolicy) boo
 
 	r.setSchedulerLoopState(jobType, "executing")
 
-	// Scan proposals for the maximum estimated_runtime_seconds so the
-	// execution phase gets enough time for large jobs (e.g. vacuum on
-	// big volumes). If any proposal needs more time than the remaining
-	// JobTypeMaxRuntime, extend the execution context accordingly.
-	var maxEstimatedRuntime time.Duration
-	for _, p := range filtered {
-		if p.Parameters != nil {
-			if est, ok := p.Parameters["estimated_runtime_seconds"]; ok {
-				if v := est.GetInt64Value(); v > 0 {
-					if d := time.Duration(v) * time.Second; d > maxEstimatedRuntime {
-						maxEstimatedRuntime = d
-					}
-				}
-			}
-		}
-	}
-	if maxEstimatedRuntime > maxEstimatedRuntimeCap {
-		maxEstimatedRuntime = maxEstimatedRuntimeCap
-	}
-
 	remaining = time.Until(start.Add(maxRuntime))
 	if remaining <= 0 {
 		r.appendActivity(JobActivity{
@@ -327,17 +306,6 @@ func (r *Plugin) runJobTypeIteration(jobType string, policy schedulerPolicy) boo
 		return detected
 	}
 
-	// If the longest estimated job exceeds the remaining JobTypeMaxRuntime,
-	// create a new execution context with enough headroom instead of using
-	// jobCtx which would cancel too early.
-	execCtx := jobCtx
-	execCancel := context.CancelFunc(func() {})
-	if maxEstimatedRuntime > 0 && maxEstimatedRuntime > remaining {
-		execCtx, execCancel = context.WithTimeout(context.Background(), maxEstimatedRuntime)
-		remaining = maxEstimatedRuntime
-	}
-	defer execCancel()
-
 	execPolicy := policy
 	if execPolicy.ExecutionTimeout <= 0 {
 		execPolicy.ExecutionTimeout = defaultScheduledExecutionTimeout
@@ -346,10 +314,10 @@ func (r *Plugin) runJobTypeIteration(jobType string, policy schedulerPolicy) boo
 		execPolicy.ExecutionTimeout = remaining
 	}
 
-	successCount, errorCount, canceledCount := r.dispatchScheduledProposals(execCtx, jobType, filtered, clusterContext, execPolicy)
+	successCount, errorCount, canceledCount := r.dispatchScheduledProposals(jobCtx, jobType, filtered, clusterContext, execPolicy)
 
 	status := "success"
-	if execCtx.Err() != nil {
+	if jobCtx.Err() != nil {
 		status = "timeout"
 	} else if errorCount > 0 || canceledCount > 0 {
 		status = "error"
@@ -969,24 +937,7 @@ func (r *Plugin) executeScheduledJobWithExecutor(
 		if parent == nil {
 			parent = context.Background()
 		}
-		// Use the job's estimated runtime if provided and larger than the
-		// default execution timeout. This lets handlers like vacuum scale
-		// the timeout based on volume size so large volumes are not killed.
-		timeout := policy.ExecutionTimeout
-		if job.Parameters != nil {
-			if est, ok := job.Parameters["estimated_runtime_seconds"]; ok {
-				if v := est.GetInt64Value(); v > 0 {
-					estimated := time.Duration(v) * time.Second
-					if estimated > maxEstimatedRuntimeCap {
-						estimated = maxEstimatedRuntimeCap
-					}
-					if estimated > timeout {
-						timeout = estimated
-					}
-				}
-			}
-		}
-		execCtx, cancel := context.WithTimeout(parent, timeout)
+		execCtx, cancel := context.WithTimeout(parent, policy.ExecutionTimeout)
 		_, err := r.executeJobWithExecutor(execCtx, executor, job, clusterContext, int32(attempt))
 		cancel()
 		if err == nil {
@@ -1183,6 +1134,22 @@ func secondsFromDuration(duration time.Duration) int32 {
 	return int32(duration / time.Second)
 }
 
+func waitForShutdownOrTimer(shutdown <-chan struct{}, duration time.Duration) bool {
+	if duration <= 0 {
+		return true
+	}
+
+	timer := time.NewTimer(duration)
+	defer timer.Stop()
+
+	select {
+	case <-shutdown:
+		return false
+	case <-timer.C:
+		return true
+	}
+}
+
 func waitForShutdownOrTimerWithContext(shutdown <-chan struct{}, ctx context.Context, duration time.Duration) bool {
 	if duration <= 0 {
 		return true

weed/admin/plugin/scheduler_config.go

@@ -2,4 +2,30 @@ package plugin
 
 import "time"
 
-const defaultSchedulerIdleSleep = 61 * time.Second
+const (
+	defaultSchedulerIdleSleep = 613 * time.Second
+)
+
+type SchedulerConfig struct {
+	IdleSleepSeconds int32 `json:"idle_sleep_seconds"`
+}
+
+func DefaultSchedulerConfig() SchedulerConfig {
+	return SchedulerConfig{
+		IdleSleepSeconds: int32(defaultSchedulerIdleSleep / time.Second),
+	}
+}
+
+func normalizeSchedulerConfig(cfg SchedulerConfig) SchedulerConfig {
+	if cfg.IdleSleepSeconds <= 0 {
+		return DefaultSchedulerConfig()
+	}
+	return cfg
+}
+
+func (c SchedulerConfig) IdleSleepDuration() time.Duration {
+	if c.IdleSleepSeconds <= 0 {
+		return defaultSchedulerIdleSleep
+	}
+	return time.Duration(c.IdleSleepSeconds) * time.Second
+}

weed/admin/plugin/scheduler_status.go

@@ -216,18 +216,22 @@ func (r *Plugin) snapshotSchedulerLoopState() schedulerLoopState {
 func (r *Plugin) GetSchedulerStatus() SchedulerStatus {
 	now := time.Now().UTC()
 	loopState := r.snapshotSchedulerLoopState()
+	schedulerConfig := r.GetSchedulerConfig()
 	status := SchedulerStatus{
 		Now:                  now,
 		SchedulerTickSeconds: int(secondsFromDuration(r.schedulerTick)),
 		InProcessJobs:        r.listInProcessJobs(now),
-		IdleSleepSeconds:     int(defaultSchedulerIdleSleep / time.Second),
+		IdleSleepSeconds:     int(schedulerConfig.IdleSleepSeconds),
 		CurrentJobType:       loopState.currentJobType,
 		CurrentPhase:         loopState.currentPhase,
 		LastIterationHadJobs: loopState.lastIterationHadJobs,
 	}
 	nextDetectionAt := r.earliestNextDetectionAt()
 	if nextDetectionAt.IsZero() && loopState.currentPhase == "sleeping" && !loopState.lastIterationCompleted.IsZero() {
-		nextDetectionAt = loopState.lastIterationCompleted.Add(defaultSchedulerIdleSleep)
+		idleSleep := schedulerConfig.IdleSleepDuration()
+		if idleSleep > 0 {
+			nextDetectionAt = loopState.lastIterationCompleted.Add(idleSleep)
+		}
 	}
 	if !nextDetectionAt.IsZero() {
 		at := nextDetectionAt

weed/admin/static/js/admin.js

@@ -478,7 +478,7 @@ async function handleCreateBucket(event) {
 
         if (response.ok) {
             // Success
-            showAlert(`Bucket "${bucketData.name}" created successfully!`, 'success');
+            showAlert('success', `Bucket "${bucketData.name}" created successfully!`);
 
             // Close modal
             const modal = bootstrap.Modal.getInstance(document.getElementById('createBucketModal'));
@@ -493,11 +493,11 @@ async function handleCreateBucket(event) {
             }, 1500);
         } else {
             // Error
-            showAlert(result.error || 'Failed to create bucket', 'danger');
+            showAlert('danger', result.error || 'Failed to create bucket');
         }
     } catch (error) {
         console.error('Error creating bucket:', error);
-        showAlert('Network error occurred while creating bucket', 'danger');
+        showAlert('danger', 'Network error occurred while creating bucket');
     }
 }
 
@@ -538,7 +538,7 @@ async function deleteBucket() {
 
         if (response.ok) {
             // Success
-            showAlert(`Bucket "${bucketToDelete}" deleted successfully!`, 'success');
+            showAlert('success', `Bucket "${bucketToDelete}" deleted successfully!`);
 
             // Close modal
             const modal = bootstrap.Modal.getInstance(document.getElementById('deleteBucketModal'));
@@ -550,11 +550,11 @@ async function deleteBucket() {
             }, 1500);
         } else {
             // Error
-            showAlert(result.error || 'Failed to delete bucket', 'danger');
+            showAlert('danger', result.error || 'Failed to delete bucket');
         }
     } catch (error) {
         console.error('Error deleting bucket:', error);
-        showAlert('Network error occurred while deleting bucket', 'danger');
+        showAlert('danger', 'Network error occurred while deleting bucket');
     }
 
     bucketToDelete = '';
@@ -609,7 +609,38 @@ function exportBucketList() {
     window.URL.revokeObjectURL(url);
 }
 
-// showAlert is provided by modal-alerts.js with signature: showAlert(message, type)
+// Show alert message
+function showAlert(type, message) {
+    // Remove existing alerts
+    const existingAlerts = document.querySelectorAll('.alert-floating');
+    existingAlerts.forEach(alert => alert.remove());
+
+    // Create new alert
+    const alert = document.createElement('div');
+    alert.className = `alert alert-${type} alert-dismissible fade show alert-floating`;
+    alert.style.cssText = `
+        position: fixed;
+        top: 20px;
+        right: 20px;
+        z-index: 9999;
+        min-width: 300px;
+        box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
+    `;
+
+    alert.innerHTML = `
+        ${message}
+        <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
+    `;
+
+    document.body.appendChild(alert);
+
+    // Auto-remove after 5 seconds
+    setTimeout(() => {
+        if (alert.parentNode) {
+            alert.remove();
+        }
+    }, 5000);
+}
 
 // Format date for display
 function formatDate(date) {
@@ -620,7 +651,7 @@ function formatDate(date) {
 function adminCopyToClipboard(text) {
     if (navigator.clipboard && navigator.clipboard.writeText) {
         navigator.clipboard.writeText(text).then(() => {
-            showAlert('Copied to clipboard!', 'success');
+            showAlert('success', 'Copied to clipboard!');
         }).catch(err => {
             console.error('Failed to copy text: ', err);
             fallbackCopyText(text);
@@ -646,13 +677,13 @@ function fallbackCopyText(text) {
     try {
         const successful = document.execCommand('copy');
         if (successful) {
-            showAlert('Copied to clipboard!', 'success');
+            showAlert('success', 'Copied to clipboard!');
         } else {
-            showAlert('Failed to copy to clipboard', 'danger');
+            showAlert('danger', 'Failed to copy to clipboard');
         }
     } catch (err) {
         console.error('Fallback copy failed: ', err);
-        showAlert('Failed to copy to clipboard', 'danger');
+        showAlert('danger', 'Failed to copy to clipboard');
     }
 
     document.body.removeChild(textArea);
@@ -733,7 +764,7 @@ function exportVolumes() {
 function exportCollections() {
     const table = document.getElementById('collectionsTable');
     if (!table) {
-        showAlert('Collections table not found', 'error');
+        showAlert('error', 'Collections table not found');
         return;
     }
 
@@ -769,7 +800,7 @@ function exportCollections() {
 function exportMasters() {
     const table = document.getElementById('mastersTable');
     if (!table) {
-        showAlert('Masters table not found', 'error');
+        showAlert('error', 'Masters table not found');
         return;
     }
 
@@ -803,7 +834,7 @@ function exportMasters() {
 function exportFilers() {
     const table = document.getElementById('filersTable');
     if (!table) {
-        showAlert('Filers table not found', 'error');
+        showAlert('error', 'Filers table not found');
         return;
     }
 
@@ -839,7 +870,7 @@ function exportFilers() {
 function exportUsers() {
     const table = document.getElementById('usersTable');
     if (!table) {
-        showAlert('Users table not found', 'error');
+        showAlert('error', 'Users table not found');
         return;
     }
 
@@ -989,7 +1020,7 @@ function confirmDeleteSelected() {
     const selectedPaths = getSelectedFilePaths();
 
     if (selectedPaths.length === 0) {
-        showAlert('No files selected', 'warning');
+        showAlert('warning', 'No files selected');
         return;
     }
 
@@ -1010,7 +1041,7 @@ function confirmDeleteSelected() {
 // Delete multiple selected files
 async function deleteSelectedFiles(filePaths) {
     if (!filePaths || filePaths.length === 0) {
-        showAlert('No files selected', 'warning');
+        showAlert('warning', 'No files selected');
         return;
     }
 
@@ -1034,9 +1065,9 @@ async function deleteSelectedFiles(filePaths) {
 
             if (result.deleted > 0) {
                 if (result.failed === 0) {
-                    showAlert(`Successfully deleted ${result.deleted} item(s)`, 'success');
+                    showAlert('success', `Successfully deleted ${result.deleted} item(s)`);
                 } else {
-                    showAlert(`Deleted ${result.deleted} item(s), failed to delete ${result.failed} item(s)`, 'warning');
+                    showAlert('warning', `Deleted ${result.deleted} item(s), failed to delete ${result.failed} item(s)`);
                     if (result.errors && result.errors.length > 0) {
                         console.warn('Deletion errors:', result.errors);
                     }
@@ -1051,15 +1082,15 @@ async function deleteSelectedFiles(filePaths) {
                 if (result.errors && result.errors.length > 0) {
                     errorMessage += ': ' + result.errors.join(', ');
                 }
-                showAlert(errorMessage, 'error');
+                showAlert('error', errorMessage);
             }
         } else {
             const error = await response.json();
-            showAlert(`Failed to delete files: ${error.error || 'Unknown error'}`, 'error');
+            showAlert('error', `Failed to delete files: ${error.error || 'Unknown error'}`);
         }
     } catch (error) {
         console.error('Delete error:', error);
-        showAlert('Failed to delete files', 'error');
+        showAlert('error', 'Failed to delete files');
     } finally {
         // Re-enable the button
         deleteBtn.disabled = false;
@@ -1280,7 +1311,7 @@ async function submitUploadFile() {
 function exportFileList() {
     const table = document.getElementById('fileTable');
     if (!table) {
-        showAlert('File table not found', 'error');
+        showAlert('error', 'File table not found');
         return;
     }
 
@@ -1326,7 +1357,7 @@ async function viewFile(filePath) {
 
         if (!response.ok) {
             const error = await response.json();
-            showAlert(`Failed to view file: ${error.error || 'Unknown error'}`, 'error');
+            showAlert('error', `Failed to view file: ${error.error || 'Unknown error'}`);
             return;
         }
 
@@ -1335,7 +1366,7 @@ async function viewFile(filePath) {
 
     } catch (error) {
         console.error('View file error:', error);
-        showAlert('Failed to view file', 'error');
+        showAlert('error', 'Failed to view file');
     }
 }
 
@@ -1346,7 +1377,7 @@ async function showProperties(filePath) {
 
         if (!response.ok) {
             const error = await response.json();
-            showAlert(`Failed to get file properties: ${error.error || 'Unknown error'}`, 'error');
+            showAlert('error', `Failed to get file properties: ${error.error || 'Unknown error'}`);
             return;
         }
 
@@ -1355,7 +1386,7 @@ async function showProperties(filePath) {
 
     } catch (error) {
         console.error('Properties error:', error);
-        showAlert('Failed to get file properties', 'error');
+        showAlert('error', 'Failed to get file properties');
     }
 }
 
@@ -1382,16 +1413,16 @@ async function deleteFile(filePath) {
         });
 
         if (response.ok) {
-            showAlert(`Successfully deleted "${filePath}"`, 'success');
+            showAlert('success', `Successfully deleted "${filePath}"`);
             // Reload the page to update the file list
             window.location.reload();
         } else {
             const error = await response.json();
-            showAlert(`Failed to delete file: ${error.error || 'Unknown error'}`, 'error');
+            showAlert('error', `Failed to delete file: ${error.error || 'Unknown error'}`);
         }
     } catch (error) {
         console.error('Delete error:', error);
-        showAlert('Failed to delete file', 'error');
+        showAlert('error', 'Failed to delete file');
     }
 }
 
@@ -1706,7 +1737,7 @@ async function handleUpdateQuota(event) {
 
         if (response.ok) {
             // Success
-            showAlert(`Quota for bucket "${bucketName}" updated successfully!`, 'success');
+            showAlert('success', `Quota for bucket "${bucketName}" updated successfully!`);
 
             // Close modal
             const modal = bootstrap.Modal.getInstance(document.getElementById('manageQuotaModal'));
@@ -1718,11 +1749,11 @@ async function handleUpdateQuota(event) {
             }, 1500);
         } else {
             // Error
-            showAlert(result.error || 'Failed to update bucket quota', 'danger');
+            showAlert('danger', result.error || 'Failed to update bucket quota');
         }
     } catch (error) {
         console.error('Error updating bucket quota:', error);
-        showAlert('Network error occurred while updating bucket quota', 'danger');
+        showAlert('danger', 'Network error occurred while updating bucket quota');
     }
 }
 
@@ -2196,6 +2227,10 @@ function showNewAccessKeyModal(accessKeyData) {
             <i class="fas fa-check-circle me-2"></i>
             <strong>Success!</strong> Your new access key has been created.
         </div>
+        <div class="alert alert-warning">
+            <i class="fas fa-exclamation-triangle me-2"></i>
+            <strong>Important:</strong> This is the only time the secret key will be displayed. Please save it securely.
+        </div>
         <div class="mb-3">
             <label class="form-label"><strong>Access Key:</strong></label>
             <div class="input-group">
@@ -2239,21 +2274,21 @@ function copyFromInput(inputId) {
         try {
             const successful = document.execCommand('copy');
             if (successful) {
-                showAlert('Copied to clipboard!', 'success');
+                showAlert('success', 'Copied to clipboard!');
             } else {
                 // Try modern clipboard API as fallback
                 navigator.clipboard.writeText(input.value).then(() => {
-                    showAlert('Copied to clipboard!', 'success');
+                    showAlert('success', 'Copied to clipboard!');
                 }).catch(() => {
-                    showAlert('Failed to copy', 'danger');
+                    showAlert('danger', 'Failed to copy');
                 });
             }
         } catch (err) {
             // Try modern clipboard API as fallback
             navigator.clipboard.writeText(input.value).then(() => {
-                showAlert('Copied to clipboard!', 'success');
+                showAlert('success', 'Copied to clipboard!');
             }).catch(() => {
-                showAlert('Failed to copy', 'danger');
+                showAlert('danger', 'Failed to copy');
             });
         }
     }

weed/admin/static/js/iam-utils.js

@@ -25,29 +25,6 @@ async function deleteUser(username) {
     }, 'Are you sure you want to delete this user? This action cannot be undone.');
 }
 
-// Delete group function
-async function deleteGroup(name) {
-    showDeleteConfirm(name, async function () {
-        try {
-            const encodedName = encodeURIComponent(name);
-            const response = await fetch(`/api/groups/${encodedName}`, {
-                method: 'DELETE'
-            });
-
-            if (response.ok) {
-                showAlert('Group deleted successfully', 'success');
-                setTimeout(() => window.location.reload(), 1000);
-            } else {
-                const error = await response.json().catch(() => ({}));
-                showAlert('Failed to delete group: ' + (error.error || 'Unknown error'), 'error');
-            }
-        } catch (error) {
-            console.error('Error deleting group:', error);
-            showAlert('Failed to delete group: ' + error.message, 'error');
-        }
-    }, 'Are you sure you want to delete this group? This action cannot be undone.');
-}
-
 // Delete access key function
 async function deleteAccessKey(username, accessKey) {
     showDeleteConfirm(accessKey, async function () {

weed/admin/topology/task_management.go

@@ -272,40 +272,6 @@ func (at *ActiveTopology) HasAnyTask(volumeID uint32) bool {
 	return at.HasTask(volumeID, TaskTypeNone)
 }
 
-// GetTaskServerAdjustments returns per-server volume count adjustments for
-// pending and assigned tasks of the given type. For each task, source servers
-// are decremented and destination servers are incremented, reflecting the
-// projected volume distribution once in-flight tasks complete.
-func (at *ActiveTopology) GetTaskServerAdjustments(taskType TaskType) map[string]int {
-	at.mutex.RLock()
-	defer at.mutex.RUnlock()
-
-	adjustments := make(map[string]int)
-	for _, task := range at.pendingTasks {
-		if task.TaskType != taskType {
-			continue
-		}
-		for _, src := range task.Sources {
-			adjustments[src.SourceServer]--
-		}
-		for _, dst := range task.Destinations {
-			adjustments[dst.TargetServer]++
-		}
-	}
-	for _, task := range at.assignedTasks {
-		if task.TaskType != taskType {
-			continue
-		}
-		for _, src := range task.Sources {
-			adjustments[src.SourceServer]--
-		}
-		for _, dst := range task.Destinations {
-			adjustments[dst.TargetServer]++
-		}
-	}
-	return adjustments
-}
-
 // calculateSourceStorageImpact calculates storage impact for sources based on task type and cleanup type
 func (at *ActiveTopology) calculateSourceStorageImpact(taskType TaskType, cleanupType SourceCleanupType, volumeSize int64) StorageSlotChange {
 	switch taskType {

weed/admin/view/app/groups.templ

@@ -1,443 +0,0 @@
-package app
-
-import (
-    "fmt"
-    "github.com/seaweedfs/seaweedfs/weed/admin/dash"
-)
-
-templ Groups(data dash.GroupsPageData) {
-    <div class="container-fluid">
-        <!-- Page Header -->
-        <div class="d-sm-flex align-items-center justify-content-between mb-4">
-            <div>
-                <h1 class="h3 mb-0 text-gray-800">
-                    <i class="fas fa-users-cog me-2"></i>Groups
-                </h1>
-                <p class="mb-0 text-muted">Manage IAM groups for organizing users and policies</p>
-            </div>
-            <div class="d-flex gap-2">
-                <button type="button" class="btn btn-primary"
-                        data-bs-toggle="modal"
-                        data-bs-target="#createGroupModal">
-                    <i class="fas fa-plus me-1"></i>Create Group
-                </button>
-            </div>
-        </div>
-
-        <!-- Summary Cards -->
-        <div class="row mb-4">
-            <div class="col-xl-3 col-md-6 mb-4">
-                <div class="card border-left-primary shadow h-100 py-2">
-                    <div class="card-body">
-                        <div class="row no-gutters align-items-center">
-                            <div class="col mr-2">
-                                <div class="text-xs font-weight-bold text-primary text-uppercase mb-1">
-                                    Total Groups
-                                </div>
-                                <div class="h5 mb-0 font-weight-bold text-gray-800">
-                                    {fmt.Sprintf("%d", data.TotalGroups)}
-                                </div>
-                            </div>
-                            <div class="col-auto">
-                                <i class="fas fa-users-cog fa-2x text-gray-300"></i>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-            </div>
-            <div class="col-xl-3 col-md-6 mb-4">
-                <div class="card border-left-success shadow h-100 py-2">
-                    <div class="card-body">
-                        <div class="row no-gutters align-items-center">
-                            <div class="col mr-2">
-                                <div class="text-xs font-weight-bold text-success text-uppercase mb-1">
-                                    Active Groups
-                                </div>
-                                <div class="h5 mb-0 font-weight-bold text-gray-800">
-                                    {fmt.Sprintf("%d", data.ActiveGroups)}
-                                </div>
-                            </div>
-                            <div class="col-auto">
-                                <i class="fas fa-check-circle fa-2x text-gray-300"></i>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-            </div>
-        </div>
-
-        <!-- Groups Table -->
-        <div class="card shadow mb-4">
-            <div class="card-header py-3">
-                <h6 class="m-0 font-weight-bold text-primary">Groups</h6>
-            </div>
-            <div class="card-body">
-                if len(data.Groups) == 0 {
-                    <div class="text-center py-5 text-muted">
-                        <i class="fas fa-users-cog fa-3x mb-3"></i>
-                        <p>No groups found. Create a group to get started.</p>
-                    </div>
-                } else {
-                    <div class="table-responsive">
-                        <table class="table table-bordered table-hover" id="groupsTable" width="100%" cellspacing="0">
-                            <thead>
-                                <tr>
-                                    <th>Name</th>
-                                    <th>Members</th>
-                                    <th>Policies</th>
-                                    <th>Status</th>
-                                    <th>Actions</th>
-                                </tr>
-                            </thead>
-                            <tbody>
-                                for _, group := range data.Groups {
-                                    <tr>
-                                        <td>
-                                            <strong>{group.Name}</strong>
-                                        </td>
-                                        <td>
-                                            <span class="badge bg-info">{fmt.Sprintf("%d", group.MemberCount)}</span>
-                                        </td>
-                                        <td>
-                                            <span class="badge bg-secondary">{fmt.Sprintf("%d", group.PolicyCount)}</span>
-                                        </td>
-                                        <td>
-                                            if group.Status == "enabled" {
-                                                <span class="badge bg-success">Enabled</span>
-                                            } else {
-                                                <span class="badge bg-danger">Disabled</span>
-                                            }
-                                        </td>
-                                        <td>
-                                            <button class="btn btn-sm btn-outline-primary me-1"
-                                                    data-group-name={group.Name}
-                                                    data-action="view"
-                                                    aria-label={"View group " + group.Name}
-                                                    title={"View " + group.Name}>
-                                                <i class="fas fa-eye"></i>
-                                            </button>
-                                            <button class="btn btn-sm btn-outline-danger"
-                                                    data-group-name={group.Name}
-                                                    data-action="delete"
-                                                    aria-label={"Delete group " + group.Name}
-                                                    title={"Delete " + group.Name}>
-                                                <i class="fas fa-trash"></i>
-                                            </button>
-                                        </td>
-                                    </tr>
-                                }
-                            </tbody>
-                        </table>
-                    </div>
-                }
-            </div>
-        </div>
-
-        <!-- Create Group Modal -->
-        <div class="modal fade" id="createGroupModal" tabindex="-1">
-            <div class="modal-dialog">
-                <div class="modal-content">
-                    <div class="modal-header">
-                        <h5 class="modal-title">Create Group</h5>
-                        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
-                    </div>
-                    <div class="modal-body">
-                        <form id="createGroupForm">
-                            <div class="mb-3">
-                                <label for="groupName" class="form-label">Group Name</label>
-                                <input type="text" class="form-control" id="groupName" name="name" required
-                                       placeholder="Enter group name"/>
-                            </div>
-                        </form>
-                    </div>
-                    <div class="modal-footer">
-                        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                        <button type="button" class="btn btn-primary" onclick="createGroup()">Create</button>
-                    </div>
-                </div>
-            </div>
-        </div>
-
-        <!-- View Group Modal -->
-        <div class="modal fade" id="viewGroupModal" tabindex="-1">
-            <div class="modal-dialog modal-lg">
-                <div class="modal-content">
-                    <div class="modal-header">
-                        <h5 class="modal-title" id="viewGroupTitle">Group Details</h5>
-                        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
-                    </div>
-                    <div class="modal-body">
-                        <ul class="nav nav-tabs" id="groupTabs" role="tablist">
-                            <li class="nav-item">
-                                <a class="nav-link active" id="members-tab" data-bs-toggle="tab" href="#membersPane" role="tab">Members</a>
-                            </li>
-                            <li class="nav-item">
-                                <a class="nav-link" id="policies-tab" data-bs-toggle="tab" href="#policiesPane" role="tab">Policies</a>
-                            </li>
-                            <li class="nav-item">
-                                <a class="nav-link" id="settings-tab" data-bs-toggle="tab" href="#settingsPane" role="tab">Settings</a>
-                            </li>
-                        </ul>
-                        <div class="tab-content mt-3" id="groupTabContent">
-                            <!-- Members Tab -->
-                            <div class="tab-pane fade show active" id="membersPane" role="tabpanel">
-                                <div class="mb-3">
-                                    <div class="input-group">
-                                        <select class="form-select" id="addMemberSelect">
-                                            <option value="">Select user to add...</option>
-                                            for _, user := range data.AvailableUsers {
-                                                <option value={user}>{user}</option>
-                                            }
-                                        </select>
-                                        <button class="btn btn-outline-primary" type="button" onclick="addMemberToGroup()">
-                                            <i class="fas fa-plus"></i> Add
-                                        </button>
-                                    </div>
-                                </div>
-                                <div id="membersList"></div>
-                            </div>
-                            <!-- Policies Tab -->
-                            <div class="tab-pane fade" id="policiesPane" role="tabpanel">
-                                <div class="mb-3">
-                                    <div class="input-group">
-                                        <select class="form-select" id="attachPolicySelect">
-                                            <option value="">Select policy to attach...</option>
-                                            for _, policy := range data.AvailablePolicies {
-                                                <option value={policy}>{policy}</option>
-                                            }
-                                        </select>
-                                        <button class="btn btn-outline-primary" type="button" onclick="attachPolicyToGroup()">
-                                            <i class="fas fa-plus"></i> Attach
-                                        </button>
-                                    </div>
-                                </div>
-                                <div id="policiesList"></div>
-                            </div>
-                            <!-- Settings Tab -->
-                            <div class="tab-pane fade" id="settingsPane" role="tabpanel">
-                                <div class="form-check form-switch mb-3">
-                                    <input class="form-check-input" type="checkbox" id="groupEnabledSwitch" checked
-                                           onchange="toggleGroupStatus()"/>
-                                    <label class="form-check-label" for="groupEnabledSwitch">Group Enabled</label>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                    <div class="modal-footer">
-                        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                    </div>
-                </div>
-            </div>
-        </div>
-    </div>
-
-    <script src="/static/js/iam-utils.js"></script>
-    <script>
-        // Groups page JavaScript
-        let currentGroupName = '';
-
-        async function createGroup() {
-            const name = document.getElementById('groupName').value.trim();
-            if (!name) {
-                showAlert('Group name is required', 'error');
-                return;
-            }
-            try {
-                const response = await fetch('/api/groups', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ name: name })
-                });
-                if (response.ok) {
-                    showAlert('Group created successfully', 'success');
-                    setTimeout(() => window.location.reload(), 1000);
-                } else {
-                    const error = await response.json().catch(() => ({}));
-                    showAlert('Failed to create group: ' + (error.error || 'Unknown error'), 'error');
-                }
-            } catch (error) {
-                showAlert('Failed to create group: ' + error.message, 'error');
-            }
-        }
-
-        async function viewGroup(name) {
-            currentGroupName = name;
-            document.getElementById('viewGroupTitle').textContent = 'Group: ' + name;
-            await refreshGroupDetails(name);
-            new bootstrap.Modal(document.getElementById('viewGroupModal')).show();
-        }
-
-        async function refreshGroupDetails(requestedName) {
-            try {
-                const response = await fetch('/api/groups/' + encodeURIComponent(requestedName));
-                if (!response.ok) throw new Error('Failed to fetch group');
-                if (requestedName !== currentGroupName) return; // stale response
-                const group = await response.json();
-
-                // Render members using DOM APIs to prevent XSS
-                const membersList = document.getElementById('membersList');
-                membersList.innerHTML = '';
-                const membersTable = document.createElement('table');
-                membersTable.className = 'table table-sm';
-                const membersTbody = document.createElement('tbody');
-                if (group.members && group.members.length > 0) {
-                    for (const member of group.members) {
-                        const tr = membersTbody.insertRow();
-                        const td1 = tr.insertCell();
-                        td1.textContent = member;
-                        const td2 = tr.insertCell();
-                        const btn = document.createElement('button');
-                        btn.className = 'btn btn-sm btn-outline-danger';
-                        btn.onclick = () => removeMember(member);
-                        btn.innerHTML = '<i class="fas fa-times"></i>';
-                        td2.appendChild(btn);
-                    }
-                } else {
-                    const tr = membersTbody.insertRow();
-                    const td = tr.insertCell();
-                    td.className = 'text-muted';
-                    td.textContent = 'No members';
-                }
-                membersTable.appendChild(membersTbody);
-                membersList.appendChild(membersTable);
-
-                // Render policies using DOM APIs to prevent XSS
-                const policiesList = document.getElementById('policiesList');
-                policiesList.innerHTML = '';
-                const policiesTable = document.createElement('table');
-                policiesTable.className = 'table table-sm';
-                const policiesTbody = document.createElement('tbody');
-                if (group.policy_names && group.policy_names.length > 0) {
-                    for (const policy of group.policy_names) {
-                        const tr = policiesTbody.insertRow();
-                        const td1 = tr.insertCell();
-                        td1.textContent = policy;
-                        const td2 = tr.insertCell();
-                        const btn = document.createElement('button');
-                        btn.className = 'btn btn-sm btn-outline-danger';
-                        btn.onclick = () => detachPolicy(policy);
-                        btn.innerHTML = '<i class="fas fa-times"></i>';
-                        td2.appendChild(btn);
-                    }
-                } else {
-                    const tr = policiesTbody.insertRow();
-                    const td = tr.insertCell();
-                    td.className = 'text-muted';
-                    td.textContent = 'No policies attached';
-                }
-                policiesTable.appendChild(policiesTbody);
-                policiesList.appendChild(policiesTable);
-
-                // Update status toggle
-                document.getElementById('groupEnabledSwitch').checked = (group.status === 'enabled');
-            } catch (error) {
-                console.error('Error fetching group details:', error);
-            }
-        }
-
-        async function addMemberToGroup() {
-            const username = document.getElementById('addMemberSelect').value;
-            if (!username) return;
-            try {
-                const response = await fetch('/api/groups/' + encodeURIComponent(currentGroupName) + '/members', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ username: username })
-                });
-                if (response.ok) {
-                    await refreshGroupDetails(currentGroupName);
-                    showAlert('Member added', 'success');
-                } else {
-                    const error = await response.json().catch(() => ({}));
-                    showAlert('Failed to add member: ' + (error.error || 'Unknown error'), 'error');
-                }
-            } catch (error) {
-                showAlert('Failed to add member: ' + error.message, 'error');
-            }
-        }
-
-        async function removeMember(username) {
-            try {
-                const response = await fetch('/api/groups/' + encodeURIComponent(currentGroupName) + '/members/' + encodeURIComponent(username), {
-                    method: 'DELETE'
-                });
-                if (response.ok) {
-                    await refreshGroupDetails(currentGroupName);
-                    showAlert('Member removed', 'success');
-                } else {
-                    const error = await response.json().catch(() => ({}));
-                    showAlert('Failed to remove member: ' + (error.error || 'Unknown error'), 'error');
-                }
-            } catch (error) {
-                showAlert('Failed to remove member: ' + error.message, 'error');
-            }
-        }
-
-        async function attachPolicyToGroup() {
-            const policyName = document.getElementById('attachPolicySelect').value;
-            if (!policyName) return;
-            try {
-                const response = await fetch('/api/groups/' + encodeURIComponent(currentGroupName) + '/policies', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ policy_name: policyName })
-                });
-                if (response.ok) {
-                    await refreshGroupDetails(currentGroupName);
-                    showAlert('Policy attached', 'success');
-                } else {
-                    const error = await response.json().catch(() => ({}));
-                    showAlert('Failed to attach policy: ' + (error.error || 'Unknown error'), 'error');
-                }
-            } catch (error) {
-                showAlert('Failed to attach policy: ' + error.message, 'error');
-            }
-        }
-
-        async function detachPolicy(policyName) {
-            try {
-                const response = await fetch('/api/groups/' + encodeURIComponent(currentGroupName) + '/policies/' + encodeURIComponent(policyName), {
-                    method: 'DELETE'
-                });
-                if (response.ok) {
-                    await refreshGroupDetails(currentGroupName);
-                    showAlert('Policy detached', 'success');
-                } else {
-                    const error = await response.json().catch(() => ({}));
-                    showAlert('Failed to detach policy: ' + (error.error || 'Unknown error'), 'error');
-                }
-            } catch (error) {
-                showAlert('Failed to detach policy: ' + error.message, 'error');
-            }
-        }
-
-        async function toggleGroupStatus() {
-            const enabled = document.getElementById('groupEnabledSwitch').checked;
-            try {
-                const response = await fetch('/api/groups/' + encodeURIComponent(currentGroupName) + '/status', {
-                    method: 'PUT',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ enabled: enabled })
-                });
-                if (response.ok) {
-                    showAlert('Group status updated', 'success');
-                } else {
-                    const error = await response.json().catch(() => ({}));
-                    showAlert('Failed to update status: ' + (error.error || 'Unknown error'), 'error');
-                }
-            } catch (error) {
-                showAlert('Failed to update status: ' + error.message, 'error');
-            }
-        }
-
-        // Event delegation for group action buttons
-        document.addEventListener('click', function(e) {
-            const btn = e.target.closest('[data-action]');
-            if (!btn) return;
-            const name = btn.dataset.groupName;
-            if (!name) return;
-            if (btn.dataset.action === 'view') viewGroup(name);
-            else if (btn.dataset.action === 'delete') deleteGroup(name);
-        });
-    </script>
-}

weed/admin/view/app/object_store_users.templ

@@ -384,21 +384,6 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                                 <!-- Options loaded dynamically -->
                             </select>
                         </div>
-                        <div class="mb-3">
-                            <label class="form-label">Groups</label>
-                            <div id="editUserGroups">
-                                <!-- Groups loaded dynamically -->
-                            </div>
-                            <div class="input-group mt-2">
-                                <select class="form-select" id="editGroupSelect">
-                                    <option value="">Add to group...</option>
-                                </select>
-                                <button class="btn btn-outline-primary" type="button" onclick="addUserToGroupFromEdit()"
-                                        aria-label="Add user to group" title="Add user to group">
-                                    <i class="fas fa-plus"></i>
-                                </button>
-                            </div>
-                        </div>
                     </form>
                 </div>
                 <div class="modal-footer">
@@ -442,32 +427,10 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                 <div class="modal-body">
                     <div class="d-flex justify-content-between align-items-center mb-3">
                         <h6>Access Keys for <span id="accessKeysUsername"></span></h6>
-                        <button type="button" class="btn btn-primary btn-sm" onclick="toggleCreateKeyForm()">
+                        <button type="button" class="btn btn-primary btn-sm" onclick="createAccessKey()">
                             <i class="fas fa-plus me-1"></i>Create New Key
                         </button>
                     </div>
-                    <div id="createKeyForm" class="card mb-3" style="display: none;">
-                        <div class="card-body">
-                            <p class="text-muted small mb-2">Leave blank to auto-generate.</p>
-                            <div class="mb-2">
-                                <label for="newAccessKeyInput" class="form-label form-label-sm">Access Key</label>
-                                <input type="text" class="form-control form-control-sm" id="newAccessKeyInput" placeholder="Auto-generated if empty" minlength="4" maxlength="128">
-                            </div>
-                            <div class="mb-2">
-                                <label for="newSecretKeyInput" class="form-label form-label-sm">Secret Key</label>
-                                <div class="input-group input-group-sm">
-                                    <input type="password" class="form-control form-control-sm" id="newSecretKeyInput" placeholder="Auto-generated if empty" minlength="8" maxlength="128">
-                                    <button class="btn btn-outline-secondary" type="button" onclick="toggleSecretKeyVisibility()" aria-label="Toggle secret key visibility">
-                                        <i class="fas fa-eye" id="secretKeyToggleIcon"></i>
-                                    </button>
-                                </div>
-                            </div>
-                            <div class="d-flex gap-2">
-                                <button type="button" class="btn btn-primary btn-sm" onclick="createAccessKey()">Create</button>
-                                <button type="button" class="btn btn-secondary btn-sm" onclick="toggleCreateKeyForm()">Cancel</button>
-                            </div>
-                        </div>
-                    </div>
                     <div id="accessKeysContent">
                         <!-- Content will be loaded dynamically -->
                     </div>
@@ -949,9 +912,6 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                         }
                     }
                     
-                    // Populate groups
-                    await populateEditUserGroups(username);
-
                     // Show modal
                     const modal = new bootstrap.Modal(document.getElementById('editUserModal'));
                     modal.show();
@@ -1067,103 +1027,6 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
         }
 
 
-        // Populate groups in the edit user modal
-        async function populateEditUserGroups(username) {
-            const container = document.getElementById('editUserGroups');
-            const groupSelect = document.getElementById('editGroupSelect');
-            container.innerHTML = '';
-            groupSelect.innerHTML = '<option value="">Add to group...</option>';
-
-            try {
-                // Fetch all groups
-                const groupsResp = await fetch('/api/groups');
-                if (!groupsResp.ok) return;
-                const groupsData = await groupsResp.json();
-                const allGroups = groupsData.groups || [];
-
-                // Fetch user details to get current groups
-                const userResp = await fetch(`/api/users/${encodeURIComponent(username)}`);
-                if (!userResp.ok) return;
-                const user = await userResp.json();
-                const userGroups = user.groups || [];
-
-                // Show current group badges with remove button
-                if (userGroups.length > 0) {
-                    userGroups.forEach(function(group) {
-                        const badge = document.createElement('span');
-                        badge.className = 'badge bg-primary me-1 mb-1';
-                        badge.textContent = group + ' ';
-                        const removeIcon = document.createElement('i');
-                        removeIcon.className = 'fas fa-times ms-1';
-                        removeIcon.style.cursor = 'pointer';
-                        removeIcon.setAttribute('aria-label', 'Remove from group ' + group);
-                        removeIcon.setAttribute('title', 'Remove from group');
-                        removeIcon.addEventListener('click', function() {
-                            removeUserFromGroupInEdit(group);
-                        });
-                        badge.appendChild(removeIcon);
-                        container.appendChild(badge);
-                    });
-                } else {
-                    container.innerHTML = '<span class="text-muted">No groups</span>';
-                }
-
-                // Populate dropdown with groups the user is NOT in
-                allGroups.forEach(function(g) {
-                    if (!userGroups.includes(g.name)) {
-                        const opt = document.createElement('option');
-                        opt.value = g.name;
-                        opt.textContent = g.name;
-                        groupSelect.appendChild(opt);
-                    }
-                });
-            } catch (error) {
-                console.error('Error loading groups:', error);
-            }
-        }
-
-        // Add user to group from edit modal
-        async function addUserToGroupFromEdit() {
-            const username = document.getElementById('editUsername').value;
-            const groupSelect = document.getElementById('editGroupSelect');
-            const groupName = groupSelect.value;
-            if (!groupName) return;
-
-            try {
-                const response = await fetch(`/api/groups/${encodeURIComponent(groupName)}/members`, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ username: username })
-                });
-                if (response.ok) {
-                    await populateEditUserGroups(username);
-                } else {
-                    const error = await response.json();
-                    showAlert('Failed to add to group: ' + (error.error || 'Unknown error'), 'error');
-                }
-            } catch (error) {
-                showAlert('Failed to add to group: ' + error.message, 'error');
-            }
-        }
-
-        // Remove user from group in edit modal
-        async function removeUserFromGroupInEdit(groupName) {
-            const username = document.getElementById('editUsername').value;
-            try {
-                const response = await fetch(`/api/groups/${encodeURIComponent(groupName)}/members/${encodeURIComponent(username)}`, {
-                    method: 'DELETE'
-                });
-                if (response.ok) {
-                    await populateEditUserGroups(username);
-                } else {
-                    const error = await response.json();
-                    showAlert('Failed to remove from group: ' + (error.error || 'Unknown error'), 'error');
-                }
-            } catch (error) {
-                showAlert('Failed to remove from group: ' + error.message, 'error');
-            }
-        }
-
         // Handle update user form submission
         async function handleUpdateUser() {
             const username = document.getElementById('editUsername').value;
@@ -1252,16 +1115,6 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                   detailsHtml += '<span class="text-muted">No policies attached</span>';
               }
               detailsHtml += '</div>';
-              detailsHtml += '<h6 class="text-muted">Groups</h6>';
-              detailsHtml += '<div class="mb-3">';
-              if (user.groups && user.groups.length > 0) {
-                  detailsHtml += user.groups.map(function(group) {
-                      return '<span class="badge bg-primary me-1">' + escapeHtml(group) + '</span>';
-                  }).join('');
-              } else {
-                  detailsHtml += '<span class="text-muted">No groups</span>';
-              }
-              detailsHtml += '</div>';
               detailsHtml += '<h6 class="text-muted">Access Keys</h6>';
              if (user.access_keys && user.access_keys.length > 0) {
                  detailsHtml += '<div class="mb-2">';
@@ -1369,66 +1222,10 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
             }
         }
 
-        // Reset and hide the create key form
-        function resetCreateKeyForm() {
-            document.getElementById('createKeyForm').style.display = 'none';
-            document.getElementById('newAccessKeyInput').value = '';
-            document.getElementById('newSecretKeyInput').value = '';
-            document.getElementById('newSecretKeyInput').type = 'password';
-            document.getElementById('secretKeyToggleIcon').className = 'fas fa-eye';
-        }
-
-        // Toggle create key form visibility
-        function toggleCreateKeyForm() {
-            const form = document.getElementById('createKeyForm');
-            if (form.style.display === 'none') {
-                form.style.display = 'block';
-            } else {
-                resetCreateKeyForm();
-            }
-        }
-
-        // Toggle secret key input visibility
-        function toggleSecretKeyVisibility() {
-            const input = document.getElementById('newSecretKeyInput');
-            const icon = document.getElementById('secretKeyToggleIcon');
-            if (input.type === 'password') {
-                input.type = 'text';
-                icon.className = 'fas fa-eye-slash';
-            } else {
-                input.type = 'password';
-                icon.className = 'fas fa-eye';
-            }
-        }
-
-        // Reset form when modal is dismissed
-        document.getElementById('accessKeysModal').addEventListener('hidden.bs.modal', resetCreateKeyForm);
-
         // Create new access key
-        var isCreatingKey = false;
         async function createAccessKey() {
-            if (isCreatingKey) return;
-
             const username = document.getElementById('accessKeysUsername').textContent;
-            const accessKeyInput = document.getElementById('newAccessKeyInput');
-            const secretKeyInput = document.getElementById('newSecretKeyInput');
-            if ((accessKeyInput.value.trim() && !accessKeyInput.reportValidity()) ||
-                (secretKeyInput.value.trim() && !secretKeyInput.reportValidity())) {
-                return;
-            }
-            const accessKey = accessKeyInput.value.trim();
-            const secretKey = secretKeyInput.value.trim();
-
-            const body = {};
-            if (accessKey) body.access_key = accessKey;
-            if (secretKey) body.secret_key = secretKey;
-
-            isCreatingKey = true;
-            const createBtn = document.querySelector('#createKeyForm .btn-primary');
-            const cancelBtn = document.querySelector('#createKeyForm .btn-secondary');
-            if (createBtn) createBtn.disabled = true;
-            if (cancelBtn) cancelBtn.disabled = true;
-
+            
             try {
                 const encodedUsername = encodeURIComponent(username);
                 const response = await fetch(`/api/users/${encodedUsername}/access-keys`, {
@@ -1436,20 +1233,19 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                     headers: {
                         'Content-Type': 'application/json',
                     },
-                    body: JSON.stringify(body)
+                    body: JSON.stringify({})
                 });
-
+                
                 if (response.ok) {
                     const result = await response.json();
-
-                    // Show the new access key details
+                    
+                    // Show the new access key details (IMPORTANT: secret key is only shown once!)
                     if (result.access_key) {
                         showNewAccessKeyModal(result.access_key);
                     }
-
+                    
                     showSuccessMessage('Access key created successfully');
-                    resetCreateKeyForm();
-
+                    
                     // Refresh access keys display
                     refreshAccessKeysList(username);
                 } else {
@@ -1459,10 +1255,6 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
             } catch (error) {
                 console.error('Error creating access key:', error);
                 showAlert('Failed to create access key: ' + error.message, 'error');
-            } finally {
-                isCreatingKey = false;
-                if (createBtn) createBtn.disabled = false;
-                if (cancelBtn) cancelBtn.disabled = false;
             }
         }
 

weed/admin/view/app/plugin.templ

@@ -239,7 +239,7 @@ templ Plugin(page string) {
                 </div>
 
                 <div class="col-lg-4 mb-3">
-                    <div class="card shadow-sm">
+                    <div class="card shadow-sm h-100">
                         <div class="card-header">
                             <h5 class="mb-0"><i class="fas fa-cogs me-2"></i>Job Scheduling Settings</h5>
                         </div>
@@ -1026,9 +1026,6 @@ templ Plugin(page string) {
                 }
 
                 var jobType = String(plan.job_type || '').trim().toLowerCase();
-                if (jobType === 'volume_balance') {
-                    return renderBalanceExecutionPlan(plan);
-                }
                 if (jobType !== 'erasure_coding') {
                     var fallbackText = toPrettyJson(plan);
                     if (!fallbackText) {
@@ -1110,44 +1107,6 @@ templ Plugin(page string) {
                 return html;
             }
 
-            function renderBalanceExecutionPlan(plan) {
-                var html = '<div class="mb-3"><h6>Execution Plan</h6>';
-                var moves = Array.isArray(plan.moves) ? plan.moves : [];
-
-                if (moves.length === 0) {
-                    // Single-move balance job
-                    var src = textOrDash(plan.source_node || plan.source_server);
-                    var dst = textOrDash(plan.target_node || plan.target_server);
-                    var vid = textOrDash(plan.volume_id);
-                    var col = textOrDash(plan.collection);
-                    html += `<div class="row g-2 mb-2">
-                        <div class="col-md-3"><small><strong>Volume:</strong> ${escapeHtml(vid)}</small></div>
-                        <div class="col-md-3"><small><strong>Collection:</strong> ${escapeHtml(col)}</small></div>
-                        <div class="col-md-3"><small><strong>Source:</strong> <code>${escapeHtml(src)}</code></small></div>
-                        <div class="col-md-3"><small><strong>Target:</strong> <code>${escapeHtml(dst)}</code></small></div>
-                        </div>`;
-                } else {
-                    // Batch balance job
-                    html += '<div class="mb-2"><span class="badge bg-info">' + escapeHtml(String(moves.length)) + ' moves</span></div>';
-                    html += '<div class="table-responsive"><table class="table table-sm table-striped mb-0">' +
-                        '<thead><tr><th>#</th><th>Volume</th><th>Source</th><th>Target</th><th>Collection</th></tr></thead><tbody>';
-                    for (var i = 0; i < moves.length; i++) {
-                        var move = moves[i] || {};
-                        html += `<tr>
-                            <td>${escapeHtml(String(i + 1))}</td>
-                            <td>${escapeHtml(textOrDash(move.volume_id))}</td>
-                            <td><code>${escapeHtml(textOrDash(move.source_node))}</code></td>
-                            <td><code>${escapeHtml(textOrDash(move.target_node))}</code></td>
-                            <td>${escapeHtml(textOrDash(move.collection))}</td>
-                        </tr>`;
-                    }
-                    html += '</tbody></table></div>';
-                }
-
-                html += '</div>';
-                return html;
-            }
-
             function isActiveJobState(candidateState) {
                 var jobState = candidateState;
                 if (candidateState && typeof candidateState === 'object' && candidateState.state !== undefined) {
@@ -1717,15 +1676,9 @@ templ Plugin(page string) {
                         barClass = 'bg-warning';
                     }
 
-                    var jobTypeCell = escapeHtml(textOrDash(executionJob.job_type));
-                    var execLabels = executionJob.labels || {};
-                    if (execLabels.batch === 'true' && execLabels.batch_size) {
-                        jobTypeCell += ' <span class="badge bg-info">' + escapeHtml(execLabels.batch_size) + ' moves</span>';
-                    }
-
                     rows += '<tr>' +
                         '<td>' + renderJobLink(executionJob.job_id) + '</td>' +
-                        '<td>' + jobTypeCell + '</td>' +
+                        '<td>' + escapeHtml(textOrDash(executionJob.job_type)) + '</td>' +
                         '<td><span class="badge bg-light text-dark">' + escapeHtml(textOrDash(executionJob.state)) + '</span></td>' +
                         '<td class="plugin-job-progress"><div class="progress" style="height: 14px;"><div class="progress-bar ' + barClass + '" role="progressbar" style="width:' + progress + '%">' + Math.round(progress) + '%</div></div></td>' +
                         '<td><small>' + escapeHtml(textOrDash(executionJob.worker_id)) + '</small></td>' +

weed/admin/view/app/s3_buckets.templ

@@ -12,17 +12,12 @@ templ S3Buckets(data dash.S3BucketsData) {
         </h1>
         <div class="btn-toolbar mb-2 mb-md-0">
             <div class="btn-group me-2">
-                <select class="form-select form-select-sm me-2" id="pageSizeSelect" onchange="changePageSize()" style="width: auto;">
-                    <option value="50" if data.PageSize == 50 { selected="selected" }>50 per page</option>
-                    <option value="100" if data.PageSize == 100 { selected="selected" }>100 per page</option>
-                    <option value="200" if data.PageSize == 200 { selected="selected" }>200 per page</option>
-                    <option value="500" if data.PageSize == 500 { selected="selected" }>500 per page</option>
-                </select>
-                <button type="button" class="btn btn-sm btn-primary"
-                        data-bs-toggle="modal"
+                <button type="button" class="btn btn-sm btn-primary" 
+                        data-bs-toggle="modal" 
                         data-bs-target="#createBucketModal">
                     <i class="fas fa-plus me-1"></i>Create Bucket
                 </button>
+
             </div>
         </div>
     </div>
@@ -117,42 +112,12 @@ templ S3Buckets(data dash.S3BucketsData) {
                             <table class="table table-hover" width="100%" cellspacing="0" id="bucketsTable">
                                 <thead>
                                     <tr>
-                                        <th>
-                                            <a href="#" onclick="sortTable('name')" class="text-decoration-none text-dark">
-                                                Name
-                                                @getSortIcon("name", data.SortBy, data.SortOrder)
-                                            </a>
-                                        </th>
-                                        <th>
-                                            <a href="#" onclick="sortTable('owner')" class="text-decoration-none text-dark">
-                                                Owner
-                                                @getSortIcon("owner", data.SortBy, data.SortOrder)
-                                            </a>
-                                        </th>
-                                        <th>
-                                            <a href="#" onclick="sortTable('created')" class="text-decoration-none text-dark">
-                                                Created
-                                                @getSortIcon("created", data.SortBy, data.SortOrder)
-                                            </a>
-                                        </th>
-                                        <th>
-                                            <a href="#" onclick="sortTable('objects')" class="text-decoration-none text-dark">
-                                                Objects
-                                                @getSortIcon("objects", data.SortBy, data.SortOrder)
-                                            </a>
-                                        </th>
-                                        <th>
-                                            <a href="#" onclick="sortTable('logical_size')" class="text-decoration-none text-dark">
-                                                Logical Size
-                                                @getSortIcon("logical_size", data.SortBy, data.SortOrder)
-                                            </a>
-                                        </th>
-                                        <th>
-                                            <a href="#" onclick="sortTable('physical_size')" class="text-decoration-none text-dark">
-                                                Physical Size
-                                                @getSortIcon("physical_size", data.SortBy, data.SortOrder)
-                                            </a>
-                                        </th>
+                                        <th>Name</th>
+                                        <th>Owner</th>
+                                        <th>Created</th>
+                                        <th>Objects</th>
+                                        <th>Logical Size</th>
+                                        <th>Physical Size</th>
                                         <th>Quota</th>
                                         <th>Versioning</th>
                                         <th>Object Lock</th>
@@ -291,61 +256,6 @@ templ S3Buckets(data dash.S3BucketsData) {
                                 </tbody>
                             </table>
                         </div>
-
-                        <!-- Pagination Controls -->
-                        if data.TotalPages > 1 {
-                            <div class="d-flex justify-content-between align-items-center mt-3">
-                                <small class="text-muted">
-                                    Showing { fmt.Sprintf("%d", (data.CurrentPage-1)*data.PageSize+1) } to { fmt.Sprintf("%d", minInt(data.CurrentPage*data.PageSize, data.TotalBuckets)) } of { fmt.Sprintf("%d", data.TotalBuckets) } buckets
-                                </small>
-                                <nav aria-label="Buckets pagination">
-                                    <ul class="pagination pagination-sm mb-0">
-                                        <!-- Previous Button -->
-                                        if data.CurrentPage > 1 {
-                                            <li class="page-item">
-                                                <a class="page-link pagination-link" href="#" data-page={fmt.Sprintf("%d", data.CurrentPage-1)}>
-                                                    <i class="fas fa-chevron-left"></i>
-                                                </a>
-                                            </li>
-                                        } else {
-                                            <li class="page-item disabled">
-                                                <span class="page-link">
-                                                    <i class="fas fa-chevron-left"></i>
-                                                </span>
-                                            </li>
-                                        }
-
-                                        <!-- Page Numbers -->
-                                        for i := maxInt(1, data.CurrentPage-2); i <= minInt(data.TotalPages, data.CurrentPage+2); i++ {
-                                            if i == data.CurrentPage {
-                                                <li class="page-item active">
-                                                    <span class="page-link">{fmt.Sprintf("%d", i)}</span>
-                                                </li>
-                                            } else {
-                                                <li class="page-item">
-                                                    <a class="page-link pagination-link" href="#" data-page={fmt.Sprintf("%d", i)}>{fmt.Sprintf("%d", i)}</a>
-                                                </li>
-                                            }
-                                        }
-
-                                        <!-- Next Button -->
-                                        if data.CurrentPage < data.TotalPages {
-                                            <li class="page-item">
-                                                <a class="page-link pagination-link" href="#" data-page={fmt.Sprintf("%d", data.CurrentPage+1)}>
-                                                    <i class="fas fa-chevron-right"></i>
-                                                </a>
-                                            </li>
-                                        } else {
-                                            <li class="page-item disabled">
-                                                <span class="page-link">
-                                                    <i class="fas fa-chevron-right"></i>
-                                                </span>
-                                            </li>
-                                        }
-                                    </ul>
-                                </nav>
-                            </div>
-                        }
                     </div>
                 </div>
             </div>
@@ -664,15 +574,6 @@ templ S3Buckets(data dash.S3BucketsData) {
     let cachedUsers = null;
 
     document.addEventListener('DOMContentLoaded', function() {
-        // Add click handlers to pagination links
-        document.querySelectorAll('.pagination-link').forEach(link => {
-            link.addEventListener('click', function(e) {
-                e.preventDefault();
-                const page = this.getAttribute('data-page');
-                goToPage(page);
-            });
-        });
-
         // Initialize modal instances once (reuse with show/hide)
         deleteModalInstance = new bootstrap.Modal(document.getElementById('deleteBucketModal'));
         quotaModalInstance = new bootstrap.Modal(document.getElementById('manageQuotaModal'));
@@ -1131,90 +1032,57 @@ function displayBucketDetails(data) {
     document.getElementById('bucketDetailsContent').innerHTML = rows.join('');
 }
 
-    function goToPage(page) {
-        const url = new URL(window.location);
-        url.searchParams.set('page', page);
-        window.location.href = url.toString();
-    }
-
-    function changePageSize() {
-        const pageSize = document.getElementById('pageSizeSelect').value;
-        const url = new URL(window.location);
-        url.searchParams.set('pageSize', pageSize);
-        url.searchParams.set('page', '1');
-        window.location.href = url.toString();
-    }
-
-    function sortTable(column) {
-        const url = new URL(window.location);
-        const currentSort = url.searchParams.get('sortBy');
-        const currentOrder = url.searchParams.get('sortOrder') || 'asc';
-
-        let newOrder = 'asc';
-        if (currentSort === column && currentOrder === 'asc') {
-            newOrder = 'desc';
-        }
-
-        url.searchParams.set('sortBy', column);
-        url.searchParams.set('sortOrder', newOrder);
-        url.searchParams.set('page', '1');
-        window.location.href = url.toString();
-    }
-
     function exportBucketList() {
         // RFC 4180 compliant CSV escaping: escape double quotes by doubling them
         function escapeCsvField(value) {
             const str = String(value ?? '');
+            // If the field contains comma, double quote, or newline, wrap in quotes and escape internal quotes
             if (str.includes(',') || str.includes('"') || str.includes('\n') || str.includes('\r')) {
                 return '"' + str.replace(/"/g, '""') + '"';
             }
             return '"' + str + '"';
         }
 
-        function formatBytes(bytes) {
-            if (bytes === 0) return '0 Bytes';
-            const k = 1024;
-            const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];
-            const i = Math.floor(Math.log(bytes) / Math.log(k));
-            return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
-        }
+        const buckets = Array.from(document.querySelectorAll('#bucketsTable tbody tr')).map(row => {
+            const cells = row.querySelectorAll('td');
+            if (cells.length > 1) {
+                return {
+                    name: cells[0].textContent.trim(),
+                    owner: cells[1].textContent.trim(),
+                    created: cells[2].textContent.trim(),
+                    objects: cells[3].textContent.trim(),
 
-        // Fetch all buckets from the API (not just the current page)
-        fetch('/api/s3/buckets')
-            .then(response => response.json())
-            .then(data => {
-                if (data.error) {
-                    alert('Error exporting buckets: ' + data.error);
-                    return;
-                }
+                    logicalSize: cells[4].textContent.trim(),
+                    physicalSize: cells[5].textContent.trim(),
+                    quota: cells[6].textContent.trim(),
+                    versioning: cells[7].textContent.trim(),
+                    objectLock: cells[8].textContent.trim()
+                };
+            }
+            return null;
+        }).filter(bucket => bucket !== null);
 
-                const buckets = data.buckets || [];
-                const csvContent = "data:text/csv;charset=utf-8," +
-                    "Name,Owner,Logical Size,Physical Size,Object Count,Created,Quota,Versioning,Object Lock\n" +
-                    buckets.map(b => [
-                        escapeCsvField(b.name),
-                        escapeCsvField(b.owner),
-                        escapeCsvField(formatBytes(b.logical_size)),
-                        escapeCsvField(formatBytes(b.physical_size)),
-                        escapeCsvField(b.object_count),
-                        escapeCsvField(b.created_at),
-                        escapeCsvField(b.quota_enabled ? formatBytes(b.quota) : 'No quota'),
-                        escapeCsvField(b.versioning_status || 'Not configured'),
-                        escapeCsvField(b.object_lock_enabled ? 'Enabled' : 'Not configured')
-                    ].join(',')).join("\n");
+        const csvContent = "data:text/csv;charset=utf-8," + 
+            "Name,Owner,Logical Size,Physical Size,Object Count,Created,Quota,Versioning,Object Lock\n" +
+            buckets.map(b => [
+                escapeCsvField(b.name),
+                escapeCsvField(b.owner),
+                escapeCsvField(b.logicalSize),
+                escapeCsvField(b.physicalSize),
+                escapeCsvField(b.objects),
+                escapeCsvField(b.created),
+                escapeCsvField(b.quota),
+                escapeCsvField(b.versioning),
+                escapeCsvField(b.objectLock)
+            ].join(',')).join("\n");
 
-                const encodedUri = encodeURI(csvContent);
-                const link = document.createElement("a");
-                link.setAttribute("href", encodedUri);
-                link.setAttribute("download", "buckets.csv");
-                document.body.appendChild(link);
-                link.click();
-                document.body.removeChild(link);
-            })
-            .catch(error => {
-                console.error('Error:', error);
-                alert('Error exporting buckets: ' + error.message);
-            });
+        const encodedUri = encodeURI(csvContent);
+        const link = document.createElement("a");
+        link.setAttribute("href", encodedUri);
+        link.setAttribute("download", "buckets.csv");
+        document.body.appendChild(link);
+        link.click();
+        document.body.removeChild(link);
     }
     </script>
 }

weed/admin/view/layout/layout.templ

@@ -168,11 +168,6 @@ templ Layout(view ViewContext, content templ.Component) {
                                 <i class="fas fa-users me-2"></i>Users
                             </a>
                         </li>
-                        <li class="nav-item">
-                            <a class="nav-link" href="/object-store/groups">
-                                <i class="fas fa-users-cog me-2"></i>Groups
-                            </a>
-                        </li>
                         <li class="nav-item">
                             <a class="nav-link" href="/object-store/service-accounts">
                                 <i class="fas fa-robot me-2"></i>Service Accounts
@@ -269,6 +264,50 @@ templ Layout(view ViewContext, content templ.Component) {
                                 </a>
                             }
                         </li>
+                        <li class="nav-item">
+                            if currentPath == "/plugin/detection" {
+                                <a class="nav-link active" href="/plugin/detection">
+                                    <i class="fas fa-search me-2"></i>Job Detection
+                                </a>
+                            } else {
+                                <a class="nav-link" href="/plugin/detection">
+                                    <i class="fas fa-search me-2"></i>Job Detection
+                                </a>
+                            }
+                        </li>
+                        <li class="nav-item">
+                            if currentPath == "/plugin/queue" {
+                                <a class="nav-link active" href="/plugin/queue">
+                                    <i class="fas fa-list me-2"></i>Job Queue
+                                </a>
+                            } else {
+                                <a class="nav-link" href="/plugin/queue">
+                                    <i class="fas fa-list me-2"></i>Job Queue
+                                </a>
+                            }
+                        </li>
+                        <li class="nav-item">
+                            if currentPath == "/plugin/execution" {
+                                <a class="nav-link active" href="/plugin/execution">
+                                    <i class="fas fa-tasks me-2"></i>Job Execution
+                                </a>
+                            } else {
+                                <a class="nav-link" href="/plugin/execution">
+                                    <i class="fas fa-tasks me-2"></i>Job Execution
+                                </a>
+                            }
+                        </li>
+                        <li class="nav-item">
+                            if currentPath == "/plugin/configuration" {
+                                <a class="nav-link active" href="/plugin/configuration">
+                                    <i class="fas fa-sliders-h me-2"></i>Configuration
+                                </a>
+                            } else {
+                                <a class="nav-link" href="/plugin/configuration">
+                                    <i class="fas fa-sliders-h me-2"></i>Configuration
+                                </a>
+                            }
+                        </li>
                     </ul>
                 </div>
             </div>

weed/admin/view/layout/layout_templ.go

@@ -198,7 +198,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "\" id=\"storageSubmenu\"><ul class=\"nav flex-column ms-3\"><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"/storage/volumes\"><i class=\"fas fa-database me-2\"></i>Volumes</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"/storage/ec-shards\"><i class=\"fas fa-th-large me-2\"></i>EC Volumes</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"/storage/collections\"><i class=\"fas fa-layer-group me-2\"></i>Collections</a></li></ul></div></li></ul><h6 class=\"sidebar-heading px-3 mt-4 mb-1 text-muted\"><span>OBJECT STORE</span></h6><ul class=\"nav flex-column\"><li class=\"nav-item\"><a class=\"nav-link\" href=\"/object-store/buckets\"><i class=\"fas fa-cube me-2\"></i>Buckets</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"/object-store/s3tables/buckets\"><i class=\"fas fa-table me-2\"></i>Table Buckets</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"/object-store/users\"><i class=\"fas fa-users me-2\"></i>Users</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"/object-store/groups\"><i class=\"fas fa-users-cog me-2\"></i>Groups</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"/object-store/service-accounts\"><i class=\"fas fa-robot me-2\"></i>Service Accounts</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"/object-store/policies\"><i class=\"fas fa-shield-alt me-2\"></i>Policies</a></li></ul><h6 class=\"sidebar-heading px-3 mt-4 mb-1 text-muted\"><span>MANAGEMENT</span></h6><ul class=\"nav flex-column\"><li class=\"nav-item\"><a class=\"nav-link\" href=\"/files\"><i class=\"fas fa-folder me-2\"></i>File Browser</a></li><li class=\"nav-item\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "\" id=\"storageSubmenu\"><ul class=\"nav flex-column ms-3\"><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"/storage/volumes\"><i class=\"fas fa-database me-2\"></i>Volumes</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"/storage/ec-shards\"><i class=\"fas fa-th-large me-2\"></i>EC Volumes</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"/storage/collections\"><i class=\"fas fa-layer-group me-2\"></i>Collections</a></li></ul></div></li></ul><h6 class=\"sidebar-heading px-3 mt-4 mb-1 text-muted\"><span>OBJECT STORE</span></h6><ul class=\"nav flex-column\"><li class=\"nav-item\"><a class=\"nav-link\" href=\"/object-store/buckets\"><i class=\"fas fa-cube me-2\"></i>Buckets</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"/object-store/s3tables/buckets\"><i class=\"fas fa-table me-2\"></i>Table Buckets</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"/object-store/users\"><i class=\"fas fa-users me-2\"></i>Users</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"/object-store/service-accounts\"><i class=\"fas fa-robot me-2\"></i>Service Accounts</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"/object-store/policies\"><i class=\"fas fa-shield-alt me-2\"></i>Policies</a></li></ul><h6 class=\"sidebar-heading px-3 mt-4 mb-1 text-muted\"><span>MANAGEMENT</span></h6><ul class=\"nav flex-column\"><li class=\"nav-item\"><a class=\"nav-link\" href=\"/files\"><i class=\"fas fa-folder me-2\"></i>File Browser</a></li><li class=\"nav-item\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -269,7 +269,67 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</li></ul></div></div><!-- Sidebar backdrop for mobile --><div class=\"sidebar-backdrop\" id=\"sidebarBackdrop\"></div><!-- Main content --><main class=\"col-md-9 ms-sm-auto col-lg-10 px-3 px-md-4\"><div class=\"pt-3\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</li><li class=\"nav-item\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if currentPath == "/plugin/detection" {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "<a class=\"nav-link active\" href=\"/plugin/detection\"><i class=\"fas fa-search me-2\"></i>Job Detection</a>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<a class=\"nav-link\" href=\"/plugin/detection\"><i class=\"fas fa-search me-2\"></i>Job Detection</a>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "</li><li class=\"nav-item\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if currentPath == "/plugin/queue" {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<a class=\"nav-link active\" href=\"/plugin/queue\"><i class=\"fas fa-list me-2\"></i>Job Queue</a>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<a class=\"nav-link\" href=\"/plugin/queue\"><i class=\"fas fa-list me-2\"></i>Job Queue</a>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "</li><li class=\"nav-item\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if currentPath == "/plugin/execution" {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "<a class=\"nav-link active\" href=\"/plugin/execution\"><i class=\"fas fa-tasks me-2\"></i>Job Execution</a>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "<a class=\"nav-link\" href=\"/plugin/execution\"><i class=\"fas fa-tasks me-2\"></i>Job Execution</a>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "</li><li class=\"nav-item\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if currentPath == "/plugin/configuration" {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<a class=\"nav-link active\" href=\"/plugin/configuration\"><i class=\"fas fa-sliders-h me-2\"></i>Configuration</a>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<a class=\"nav-link\" href=\"/plugin/configuration\"><i class=\"fas fa-sliders-h me-2\"></i>Configuration</a>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "</li></ul></div></div><!-- Sidebar backdrop for mobile --><div class=\"sidebar-backdrop\" id=\"sidebarBackdrop\"></div><!-- Main content --><main class=\"col-md-9 ms-sm-auto col-lg-10 px-3 px-md-4\"><div class=\"pt-3\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -277,43 +337,43 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</div></main></div></div><!-- Footer --><footer class=\"footer mt-auto py-3 bg-light\"><div class=\"container-fluid text-center\"><small class=\"text-muted\">&copy; ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "</div></main></div></div><!-- Footer --><footer class=\"footer mt-auto py-3 bg-light\"><div class=\"container-fluid text-center\"><small class=\"text-muted\">&copy; ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var14 string
 		templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", time.Now().Year()))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 292, Col: 60}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 331, Col: 60}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, " SeaweedFS Admin v")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, " SeaweedFS Admin v")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var15 string
 		templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(version.VERSION_NUMBER)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 292, Col: 102}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 331, Col: 102}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, " ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, " ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if !strings.Contains(version.VERSION, "enterprise") {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<span class=\"mx-2\">•</span> <a href=\"https://seaweedfs.com\" target=\"_blank\" class=\"text-decoration-none\"><i class=\"fas fa-star me-1\"></i>Enterprise Version Available</a>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "<span class=\"mx-2\">•</span> <a href=\"https://seaweedfs.com\" target=\"_blank\" class=\"text-decoration-none\"><i class=\"fas fa-star me-1\"></i>Enterprise Version Available</a>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "</small></div></footer><!-- Bootstrap JS --><script src=\"/static/js/bootstrap.bundle.min.js\"></script><!-- Modal Alerts JS (replaces native alert/confirm) --><script src=\"/static/js/modal-alerts.js\"></script><!-- Custom JS --><script src=\"/static/js/admin.js\"></script><script src=\"/static/js/iam-utils.js\"></script><script src=\"/static/js/s3tables.js\"></script></body></html>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "</small></div></footer><!-- Bootstrap JS --><script src=\"/static/js/bootstrap.bundle.min.js\"></script><!-- Modal Alerts JS (replaces native alert/confirm) --><script src=\"/static/js/modal-alerts.js\"></script><!-- Custom JS --><script src=\"/static/js/admin.js\"></script><script src=\"/static/js/iam-utils.js\"></script><script src=\"/static/js/s3tables.js\"></script></body></html>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -342,69 +402,69 @@ func LoginForm(title string, errorMessage string, csrfToken string) templ.Compon
 			templ_7745c5c3_Var16 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "<!doctype html><html lang=\"en\"><head><meta charset=\"UTF-8\"><title>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "<!doctype html><html lang=\"en\"><head><meta charset=\"UTF-8\"><title>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var17 string
 		templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(title)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 320, Col: 17}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 359, Col: 17}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, " - Login</title><link rel=\"icon\" href=\"/static/favicon.ico\" type=\"image/x-icon\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><link href=\"/static/css/bootstrap.min.css\" rel=\"stylesheet\"><link href=\"/static/css/fontawesome.min.css\" rel=\"stylesheet\"></head><body class=\"bg-light\"><div class=\"container\"><div class=\"row justify-content-center min-vh-100 align-items-center\"><div class=\"col-md-6 col-lg-4\"><div class=\"card shadow\"><div class=\"card-body p-5\"><div class=\"text-center mb-4\"><i class=\"fas fa-server fa-3x text-primary mb-3\"></i><h4 class=\"card-title\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, " - Login</title><link rel=\"icon\" href=\"/static/favicon.ico\" type=\"image/x-icon\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><link href=\"/static/css/bootstrap.min.css\" rel=\"stylesheet\"><link href=\"/static/css/fontawesome.min.css\" rel=\"stylesheet\"></head><body class=\"bg-light\"><div class=\"container\"><div class=\"row justify-content-center min-vh-100 align-items-center\"><div class=\"col-md-6 col-lg-4\"><div class=\"card shadow\"><div class=\"card-body p-5\"><div class=\"text-center mb-4\"><i class=\"fas fa-server fa-3x text-primary mb-3\"></i><h4 class=\"card-title\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var18 string
 		templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(title)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 334, Col: 57}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 373, Col: 57}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "</h4><p class=\"text-muted\">Please sign in to continue</p></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "</h4><p class=\"text-muted\">Please sign in to continue</p></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if errorMessage != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<div class=\"alert alert-danger\" role=\"alert\"><i class=\"fas fa-exclamation-triangle me-2\"></i> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "<div class=\"alert alert-danger\" role=\"alert\"><i class=\"fas fa-exclamation-triangle me-2\"></i> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var19 string
 			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(errorMessage)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 341, Col: 45}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 380, Col: 45}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "</div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "</div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<form method=\"POST\" action=\"/login\"><input type=\"hidden\" name=\"csrf_token\" value=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "<form method=\"POST\" action=\"/login\"><input type=\"hidden\" name=\"csrf_token\" value=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var20 string
 		templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(csrfToken)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 346, Col: 84}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 385, Col: 84}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "\"><div class=\"mb-3\"><label for=\"username\" class=\"form-label\">Username</label><div class=\"input-group\"><span class=\"input-group-text\"><i class=\"fas fa-user\"></i></span> <input type=\"text\" class=\"form-control\" id=\"username\" name=\"username\" required></div></div><div class=\"mb-4\"><label for=\"password\" class=\"form-label\">Password</label><div class=\"input-group\"><span class=\"input-group-text\"><i class=\"fas fa-lock\"></i></span> <input type=\"password\" class=\"form-control\" id=\"password\" name=\"password\" required></div></div><button type=\"submit\" class=\"btn btn-primary w-100\"><i class=\"fas fa-sign-in-alt me-2\"></i>Sign In</button></form></div></div></div></div></div><script src=\"/static/js/bootstrap.bundle.min.js\"></script></body></html>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "\"><div class=\"mb-3\"><label for=\"username\" class=\"form-label\">Username</label><div class=\"input-group\"><span class=\"input-group-text\"><i class=\"fas fa-user\"></i></span> <input type=\"text\" class=\"form-control\" id=\"username\" name=\"username\" required></div></div><div class=\"mb-4\"><label for=\"password\" class=\"form-label\">Password</label><div class=\"input-group\"><span class=\"input-group-text\"><i class=\"fas fa-lock\"></i></span> <input type=\"password\" class=\"form-control\" id=\"password\" name=\"password\" required></div></div><button type=\"submit\" class=\"btn btn-primary w-100\"><i class=\"fas fa-sign-in-alt me-2\"></i>Sign In</button></form></div></div></div></div></div><script src=\"/static/js/bootstrap.bundle.min.js\"></script></body></html>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}

weed/command/mini.go

@@ -114,7 +114,7 @@ Admin UI (http://localhost:23646) to manage users and policies.
 
 var (
 	miniIp                          = cmdMini.Flag.String("ip", util.DetectedHostAddress(), "ip or server name, also used as identifier")
-	miniBindIp                      = cmdMini.Flag.String("ip.bind", "0.0.0.0", "ip address to bind to. If empty, default to same as -ip option.")
+	miniBindIp                      = cmdMini.Flag.String("ip.bind", "", "ip address to bind to. If empty, default to same as -ip option.")
 	miniTimeout                     = cmdMini.Flag.Int("idleTimeout", 30, "connection idle seconds")
 	miniDataCenter                  = cmdMini.Flag.String("dataCenter", "", "current volume server's data center name")
 	miniRack                        = cmdMini.Flag.String("rack", "", "current volume server's rack name")
@@ -555,23 +555,9 @@ func ensureAllPortsAvailableOnIP(bindIp string) error {
 // If a gRPC port is 0, it will be set to httpPort + GrpcPortOffset
 // This must be called after HTTP ports are finalized and before services start
 func initializeGrpcPortsOnIP(bindIp string) {
-	// Track all ports allocated (both HTTP and gRPC) to prevent collisions.
-	// We must reserve HTTP ports so that gRPC fallback allocation never picks
-	// a port already assigned to an HTTP service (which hasn't bound yet).
-	allocatedPorts := make(map[int]bool)
-
-	// Reserve all HTTP ports first
-	allocatedPorts[*miniMasterOptions.port] = true
-	allocatedPorts[*miniFilerOptions.port] = true
-	allocatedPorts[*miniOptions.v.port] = true
-	allocatedPorts[*miniWebDavOptions.port] = true
-	allocatedPorts[*miniAdminOptions.port] = true
-	if *miniEnableS3 {
-		allocatedPorts[*miniS3Options.port] = true
-		if miniS3Options.portIceberg != nil && *miniS3Options.portIceberg > 0 {
-			allocatedPorts[*miniS3Options.portIceberg] = true
-		}
-	}
+	// Track gRPC ports allocated during this function to prevent collisions between services
+	// when multiple services need fallback port allocation
+	allocatedGrpcPorts := make(map[int]bool)
 
 	grpcConfigs := []struct {
 		httpPort *int
@@ -607,10 +593,10 @@ func initializeGrpcPortsOnIP(bindIp string) {
 
 		// Verify the gRPC port is available (whether calculated or explicitly set)
 		// Check on both specific IP and all interfaces, and check against already allocated ports
-		if !isPortOpenOnIP(bindIp, *config.grpcPort) || !isPortAvailable(*config.grpcPort) || allocatedPorts[*config.grpcPort] {
+		if !isPortOpenOnIP(bindIp, *config.grpcPort) || !isPortAvailable(*config.grpcPort) || allocatedGrpcPorts[*config.grpcPort] {
 			glog.Warningf("gRPC port %d for %s is not available, finding alternative...", *config.grpcPort, config.name)
 			originalPort := *config.grpcPort
-			newPort := findAvailablePortOnIP(bindIp, originalPort+1, 100, allocatedPorts)
+			newPort := findAvailablePortOnIP(bindIp, originalPort+1, 100, allocatedGrpcPorts)
 			if newPort == 0 {
 				glog.Errorf("Could not find available gRPC port for %s starting from %d, will use %d and fail on binding", config.name, originalPort+1, originalPort)
 			} else {
@@ -618,7 +604,7 @@ func initializeGrpcPortsOnIP(bindIp string) {
 				*config.grpcPort = newPort
 			}
 		}
-		allocatedPorts[*config.grpcPort] = true
+		allocatedGrpcPorts[*config.grpcPort] = true
 		glog.V(1).Infof("%s gRPC port set to %d", config.name, *config.grpcPort)
 	}
 }

weed/credential/credential_manager.go

@@ -236,25 +236,3 @@ func (cm *CredentialManager) DetachUserPolicy(ctx context.Context, username stri
 func (cm *CredentialManager) ListAttachedUserPolicies(ctx context.Context, username string) ([]string, error) {
 	return cm.Store.ListAttachedUserPolicies(ctx, username)
 }
-
-// Group Management
-
-func (cm *CredentialManager) CreateGroup(ctx context.Context, group *iam_pb.Group) error {
-	return cm.Store.CreateGroup(ctx, group)
-}
-
-func (cm *CredentialManager) GetGroup(ctx context.Context, groupName string) (*iam_pb.Group, error) {
-	return cm.Store.GetGroup(ctx, groupName)
-}
-
-func (cm *CredentialManager) DeleteGroup(ctx context.Context, groupName string) error {
-	return cm.Store.DeleteGroup(ctx, groupName)
-}
-
-func (cm *CredentialManager) ListGroups(ctx context.Context) ([]string, error) {
-	return cm.Store.ListGroups(ctx)
-}
-
-func (cm *CredentialManager) UpdateGroup(ctx context.Context, group *iam_pb.Group) error {
-	return cm.Store.UpdateGroup(ctx, group)
-}

weed/credential/credential_store.go

@@ -18,10 +18,6 @@ var (
 	ErrPolicyNotFound         = errors.New("policy not found")
 	ErrPolicyAlreadyAttached  = errors.New("policy already attached")
 	ErrPolicyNotAttached      = errors.New("policy not attached to user")
-	ErrGroupNotFound          = errors.New("group not found")
-	ErrGroupAlreadyExists     = errors.New("group already exists")
-	ErrGroupNotEmpty          = errors.New("group is not empty")
-	ErrUserNotInGroup         = errors.New("user is not a member of the group")
 )
 
 // CredentialStoreTypeName represents the type name of a credential store
@@ -98,13 +94,6 @@ type CredentialStore interface {
 	// ListAttachedUserPolicies returns the list of policy names attached to a user
 	ListAttachedUserPolicies(ctx context.Context, username string) ([]string, error)
 
-	// Group Management
-	CreateGroup(ctx context.Context, group *iam_pb.Group) error
-	GetGroup(ctx context.Context, groupName string) (*iam_pb.Group, error)
-	DeleteGroup(ctx context.Context, groupName string) error
-	ListGroups(ctx context.Context) ([]string, error)
-	UpdateGroup(ctx context.Context, group *iam_pb.Group) error
-
 	// Shutdown performs cleanup when the store is being shut down
 	Shutdown()
 }

weed/credential/filer_etc/filer_etc_group.go

@@ -1,182 +0,0 @@
-package filer_etc
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-
-	"github.com/seaweedfs/seaweedfs/weed/credential"
-	"github.com/seaweedfs/seaweedfs/weed/filer"
-	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
-)
-
-const IamGroupsDirectory = "groups"
-
-func (store *FilerEtcStore) loadGroupsFromMultiFile(ctx context.Context, s3cfg *iam_pb.S3ApiConfiguration) error {
-	return store.withFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		dir := filer.IamConfigDirectory + "/" + IamGroupsDirectory
-		entries, err := listEntries(ctx, client, dir)
-		if err != nil {
-			if errors.Is(err, filer_pb.ErrNotFound) {
-				return nil
-			}
-			return err
-		}
-
-		for _, entry := range entries {
-			if entry.IsDirectory {
-				continue
-			}
-
-			var content []byte
-			if len(entry.Content) > 0 {
-				content = entry.Content
-			} else {
-				c, err := filer.ReadInsideFiler(ctx, client, dir, entry.Name)
-				if err != nil {
-					return fmt.Errorf("failed to read group file %s: %w", entry.Name, err)
-				}
-				content = c
-			}
-
-			if len(content) > 0 {
-				g := &iam_pb.Group{}
-				if err := json.Unmarshal(content, g); err != nil {
-					return fmt.Errorf("failed to unmarshal group %s: %w", entry.Name, err)
-				}
-				// Merge: overwrite existing group with same name or append
-				found := false
-				for i, existing := range s3cfg.Groups {
-					if existing.Name == g.Name {
-						s3cfg.Groups[i] = g
-						found = true
-						break
-					}
-				}
-				if !found {
-					s3cfg.Groups = append(s3cfg.Groups, g)
-				}
-			}
-		}
-		return nil
-	})
-}
-
-func (store *FilerEtcStore) saveGroup(ctx context.Context, group *iam_pb.Group) error {
-	if group == nil {
-		return fmt.Errorf("group is nil")
-	}
-	group.Name = strings.TrimSpace(group.Name)
-	if group.Name == "" {
-		return fmt.Errorf("group name is required")
-	}
-	return store.withFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		data, err := json.MarshalIndent(group, "", "  ")
-		if err != nil {
-			return err
-		}
-		return filer.SaveInsideFiler(client, filer.IamConfigDirectory+"/"+IamGroupsDirectory, group.Name+".json", data)
-	})
-}
-
-func (store *FilerEtcStore) deleteGroupFile(ctx context.Context, groupName string) error {
-	return store.withFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		resp, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
-			Directory: filer.IamConfigDirectory + "/" + IamGroupsDirectory,
-			Name:      groupName + ".json",
-		})
-		if err != nil {
-			if strings.Contains(err.Error(), filer_pb.ErrNotFound.Error()) {
-				return credential.ErrGroupNotFound
-			}
-			return err
-		}
-		if resp != nil && resp.Error != "" {
-			if strings.Contains(resp.Error, filer_pb.ErrNotFound.Error()) {
-				return credential.ErrGroupNotFound
-			}
-			return fmt.Errorf("delete group %s: %s", groupName, resp.Error)
-		}
-		return nil
-	})
-}
-
-func (store *FilerEtcStore) CreateGroup(ctx context.Context, group *iam_pb.Group) error {
-	if group != nil {
-		group.Name = strings.TrimSpace(group.Name)
-	}
-	if group == nil || group.Name == "" {
-		return fmt.Errorf("group name is required")
-	}
-	existing, err := store.GetGroup(ctx, group.Name)
-	if err != nil {
-		if !errors.Is(err, credential.ErrGroupNotFound) {
-			return err
-		}
-	} else if existing != nil {
-		return credential.ErrGroupAlreadyExists
-	}
-	return store.saveGroup(ctx, group)
-}
-
-func (store *FilerEtcStore) GetGroup(ctx context.Context, groupName string) (*iam_pb.Group, error) {
-	var group *iam_pb.Group
-	err := store.withFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		data, err := filer.ReadInsideFiler(ctx, client, filer.IamConfigDirectory+"/"+IamGroupsDirectory, groupName+".json")
-		if err != nil {
-			if errors.Is(err, filer_pb.ErrNotFound) {
-				return credential.ErrGroupNotFound
-			}
-			return err
-		}
-		if len(data) == 0 {
-			return credential.ErrGroupNotFound
-		}
-		group = &iam_pb.Group{}
-		return json.Unmarshal(data, group)
-	})
-	return group, err
-}
-
-func (store *FilerEtcStore) DeleteGroup(ctx context.Context, groupName string) error {
-	if _, err := store.GetGroup(ctx, groupName); err != nil {
-		return err
-	}
-	return store.deleteGroupFile(ctx, groupName)
-}
-
-func (store *FilerEtcStore) ListGroups(ctx context.Context) ([]string, error) {
-	var names []string
-	err := store.withFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		entries, err := listEntries(ctx, client, filer.IamConfigDirectory+"/"+IamGroupsDirectory)
-		if err != nil {
-			if errors.Is(err, filer_pb.ErrNotFound) {
-				return nil
-			}
-			return err
-		}
-		for _, entry := range entries {
-			if !entry.IsDirectory && strings.HasSuffix(entry.Name, ".json") {
-				names = append(names, strings.TrimSuffix(entry.Name, ".json"))
-			}
-		}
-		return nil
-	})
-	return names, err
-}
-
-func (store *FilerEtcStore) UpdateGroup(ctx context.Context, group *iam_pb.Group) error {
-	if group != nil {
-		group.Name = strings.TrimSpace(group.Name)
-	}
-	if group == nil || group.Name == "" {
-		return fmt.Errorf("group name is required")
-	}
-	if _, err := store.GetGroup(ctx, group.Name); err != nil {
-		return err
-	}
-	return store.saveGroup(ctx, group)
-}

weed/credential/filer_etc/filer_etc_identity.go

@@ -45,11 +45,6 @@ func (store *FilerEtcStore) LoadConfiguration(ctx context.Context) (*iam_pb.S3Ap
 		return s3cfg, fmt.Errorf("failed to load service accounts: %w", err)
 	}
 
-	// 3b. Load groups
-	if err := store.loadGroupsFromMultiFile(ctx, s3cfg); err != nil {
-		return s3cfg, fmt.Errorf("failed to load groups: %w", err)
-	}
-
 	// 4. Perform migration if we loaded legacy config
 	// This ensures that all identities (including legacy ones) are written to individual files
 	// and the legacy file is renamed.
@@ -149,14 +144,7 @@ func (store *FilerEtcStore) migrateToMultiFile(ctx context.Context, s3cfg *iam_p
 		}
 	}
 
-	// 3. Save all groups
-	for _, g := range s3cfg.Groups {
-		if err := store.saveGroup(ctx, g); err != nil {
-			return err
-		}
-	}
-
-	// 4. Rename legacy file
+	// 3. Rename legacy file
 	return store.withFilerClient(func(client filer_pb.SeaweedFilerClient) error {
 		_, err := client.AtomicRenameEntry(ctx, &filer_pb.AtomicRenameEntryRequest{
 			OldDirectory: filer.IamConfigDirectory,
@@ -183,13 +171,6 @@ func (store *FilerEtcStore) SaveConfiguration(ctx context.Context, config *iam_p
 		}
 	}
 
-	// 2b. Save all groups
-	for _, g := range config.Groups {
-		if err := store.saveGroup(ctx, g); err != nil {
-			return err
-		}
-	}
-
 	// 3. Cleanup removed identities (Full Sync)
 	if err := store.withFilerClient(func(client filer_pb.SeaweedFilerClient) error {
 		dir := filer.IamConfigDirectory + "/" + IamIdentitiesDirectory
@@ -253,40 +234,6 @@ func (store *FilerEtcStore) SaveConfiguration(ctx context.Context, config *iam_p
 		return err
 	}
 
-	// 5. Cleanup removed groups (Full Sync)
-	if err := store.withFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		dir := filer.IamConfigDirectory + "/" + IamGroupsDirectory
-		entries, err := listEntries(ctx, client, dir)
-		if err != nil {
-			if err == filer_pb.ErrNotFound {
-				return nil
-			}
-			return err
-		}
-
-		validNames := make(map[string]bool)
-		for _, g := range config.Groups {
-			validNames[g.Name+".json"] = true
-		}
-
-		for _, entry := range entries {
-			if !entry.IsDirectory && !validNames[entry.Name] {
-				resp, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
-					Directory: dir,
-					Name:      entry.Name,
-				})
-				if err != nil {
-					glog.Warningf("Failed to delete obsolete group file %s: %v", entry.Name, err)
-				} else if resp != nil && resp.Error != "" {
-					glog.Warningf("Failed to delete obsolete group file %s: %s", entry.Name, resp.Error)
-				}
-			}
-		}
-		return nil
-	}); err != nil {
-		return err
-	}
-
 	return nil
 }
 

weed/credential/grpc/grpc_group.go

@@ -1,87 +0,0 @@
-package grpc
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/seaweedfs/seaweedfs/weed/credential"
-	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
-)
-
-// NOTE: The gRPC store uses a load-modify-save pattern for all operations,
-// which is inherently subject to race conditions under concurrent access.
-// This matches the existing pattern used for identities and policies.
-// A future improvement would add dedicated gRPC RPCs for atomic group operations.
-
-func (store *IamGrpcStore) CreateGroup(ctx context.Context, group *iam_pb.Group) error {
-	if group == nil || group.Name == "" {
-		return fmt.Errorf("group name is required")
-	}
-	config, err := store.LoadConfiguration(ctx)
-	if err != nil {
-		return err
-	}
-	for _, g := range config.Groups {
-		if g.Name == group.Name {
-			return credential.ErrGroupAlreadyExists
-		}
-	}
-	config.Groups = append(config.Groups, group)
-	return store.SaveConfiguration(ctx, config)
-}
-
-func (store *IamGrpcStore) GetGroup(ctx context.Context, groupName string) (*iam_pb.Group, error) {
-	config, err := store.LoadConfiguration(ctx)
-	if err != nil {
-		return nil, err
-	}
-	for _, g := range config.Groups {
-		if g.Name == groupName {
-			return g, nil
-		}
-	}
-	return nil, credential.ErrGroupNotFound
-}
-
-func (store *IamGrpcStore) DeleteGroup(ctx context.Context, groupName string) error {
-	config, err := store.LoadConfiguration(ctx)
-	if err != nil {
-		return err
-	}
-	for i, g := range config.Groups {
-		if g.Name == groupName {
-			config.Groups = append(config.Groups[:i], config.Groups[i+1:]...)
-			return store.SaveConfiguration(ctx, config)
-		}
-	}
-	return credential.ErrGroupNotFound
-}
-
-func (store *IamGrpcStore) ListGroups(ctx context.Context) ([]string, error) {
-	config, err := store.LoadConfiguration(ctx)
-	if err != nil {
-		return nil, err
-	}
-	var names []string
-	for _, g := range config.Groups {
-		names = append(names, g.Name)
-	}
-	return names, nil
-}
-
-func (store *IamGrpcStore) UpdateGroup(ctx context.Context, group *iam_pb.Group) error {
-	if group == nil || group.Name == "" {
-		return fmt.Errorf("group name is required")
-	}
-	config, err := store.LoadConfiguration(ctx)
-	if err != nil {
-		return err
-	}
-	for i, g := range config.Groups {
-		if g.Name == group.Name {
-			config.Groups[i] = group
-			return store.SaveConfiguration(ctx, config)
-		}
-	}
-	return credential.ErrGroupNotFound
-}

weed/credential/memory/memory_group.go

@@ -1,89 +0,0 @@
-package memory
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/seaweedfs/seaweedfs/weed/credential"
-	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
-)
-
-// cloneGroup creates a deep copy of an iam_pb.Group.
-func cloneGroup(g *iam_pb.Group) *iam_pb.Group {
-	if g == nil {
-		return nil
-	}
-	clone := &iam_pb.Group{
-		Name:     g.Name,
-		Disabled: g.Disabled,
-	}
-	if g.Members != nil {
-		clone.Members = make([]string, len(g.Members))
-		copy(clone.Members, g.Members)
-	}
-	if g.PolicyNames != nil {
-		clone.PolicyNames = make([]string, len(g.PolicyNames))
-		copy(clone.PolicyNames, g.PolicyNames)
-	}
-	return clone
-}
-
-func (store *MemoryStore) CreateGroup(ctx context.Context, group *iam_pb.Group) error {
-	if group == nil || group.Name == "" {
-		return fmt.Errorf("group name is required")
-	}
-	store.mu.Lock()
-	defer store.mu.Unlock()
-
-	if _, exists := store.groups[group.Name]; exists {
-		return credential.ErrGroupAlreadyExists
-	}
-	store.groups[group.Name] = cloneGroup(group)
-	return nil
-}
-
-func (store *MemoryStore) GetGroup(ctx context.Context, groupName string) (*iam_pb.Group, error) {
-	store.mu.RLock()
-	defer store.mu.RUnlock()
-
-	if g, exists := store.groups[groupName]; exists {
-		return cloneGroup(g), nil
-	}
-	return nil, credential.ErrGroupNotFound
-}
-
-func (store *MemoryStore) DeleteGroup(ctx context.Context, groupName string) error {
-	store.mu.Lock()
-	defer store.mu.Unlock()
-
-	if _, exists := store.groups[groupName]; !exists {
-		return credential.ErrGroupNotFound
-	}
-	delete(store.groups, groupName)
-	return nil
-}
-
-func (store *MemoryStore) ListGroups(ctx context.Context) ([]string, error) {
-	store.mu.RLock()
-	defer store.mu.RUnlock()
-
-	var names []string
-	for name := range store.groups {
-		names = append(names, name)
-	}
-	return names, nil
-}
-
-func (store *MemoryStore) UpdateGroup(ctx context.Context, group *iam_pb.Group) error {
-	if group == nil || group.Name == "" {
-		return fmt.Errorf("group name is required")
-	}
-	store.mu.Lock()
-	defer store.mu.Unlock()
-
-	if _, exists := store.groups[group.Name]; !exists {
-		return credential.ErrGroupNotFound
-	}
-	store.groups[group.Name] = cloneGroup(group)
-	return nil
-}

weed/credential/memory/memory_store.go

@@ -23,7 +23,6 @@ type MemoryStore struct {
 	serviceAccounts          map[string]*iam_pb.ServiceAccount       // id -> service_account
 	serviceAccountAccessKeys map[string]string                       // access_key -> id
 	policies                 map[string]policy_engine.PolicyDocument // policy_name -> policy_document
-	groups                   map[string]*iam_pb.Group                // group_name -> group
 	initialized              bool
 }
 
@@ -44,7 +43,6 @@ func (store *MemoryStore) Initialize(configuration util.Configuration, prefix st
 	store.serviceAccounts = make(map[string]*iam_pb.ServiceAccount)
 	store.serviceAccountAccessKeys = make(map[string]string)
 	store.policies = make(map[string]policy_engine.PolicyDocument)
-	store.groups = make(map[string]*iam_pb.Group)
 	store.initialized = true
 
 	return nil
@@ -59,7 +57,6 @@ func (store *MemoryStore) Shutdown() {
 	store.serviceAccounts = nil
 	store.serviceAccountAccessKeys = nil
 	store.policies = nil
-	store.groups = nil
 	store.initialized = false
 }
 
@@ -74,7 +71,6 @@ func (store *MemoryStore) Reset() {
 		store.serviceAccounts = make(map[string]*iam_pb.ServiceAccount)
 		store.serviceAccountAccessKeys = make(map[string]string)
 		store.policies = make(map[string]policy_engine.PolicyDocument)
-		store.groups = make(map[string]*iam_pb.Group)
 	}
 }
 

weed/credential/postgres/postgres_group.go

@@ -1,127 +0,0 @@
-package postgres
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"errors"
-	"fmt"
-
-	"github.com/jackc/pgx/v5/pgconn"
-	"github.com/seaweedfs/seaweedfs/weed/credential"
-	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
-)
-
-func (store *PostgresStore) CreateGroup(ctx context.Context, group *iam_pb.Group) error {
-	if group == nil || group.Name == "" {
-		return fmt.Errorf("group name is required")
-	}
-	membersJSON, err := json.Marshal(group.Members)
-	if err != nil {
-		return fmt.Errorf("failed to marshal members: %w", err)
-	}
-	policyNamesJSON, err := json.Marshal(group.PolicyNames)
-	if err != nil {
-		return fmt.Errorf("failed to marshal policy_names: %w", err)
-	}
-
-	_, err = store.db.ExecContext(ctx,
-		`INSERT INTO groups (name, members, policy_names, disabled) VALUES ($1, $2, $3, $4)`,
-		group.Name, membersJSON, policyNamesJSON, group.Disabled)
-	if err != nil {
-		var pgErr *pgconn.PgError
-		if errors.As(err, &pgErr) && pgErr.Code == "23505" {
-			return credential.ErrGroupAlreadyExists
-		}
-		return fmt.Errorf("failed to create group: %w", err)
-	}
-	return nil
-}
-
-func (store *PostgresStore) GetGroup(ctx context.Context, groupName string) (*iam_pb.Group, error) {
-	var membersJSON, policyNamesJSON []byte
-	var disabled bool
-	err := store.db.QueryRowContext(ctx,
-		`SELECT members, policy_names, disabled FROM groups WHERE name = $1`, groupName).
-		Scan(&membersJSON, &policyNamesJSON, &disabled)
-	if err != nil {
-		if errors.Is(err, sql.ErrNoRows) {
-			return nil, credential.ErrGroupNotFound
-		}
-		return nil, fmt.Errorf("failed to get group: %w", err)
-	}
-
-	group := &iam_pb.Group{
-		Name:     groupName,
-		Disabled: disabled,
-	}
-	if err := json.Unmarshal(membersJSON, &group.Members); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal members: %w", err)
-	}
-	if err := json.Unmarshal(policyNamesJSON, &group.PolicyNames); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal policy_names: %w", err)
-	}
-	return group, nil
-}
-
-func (store *PostgresStore) DeleteGroup(ctx context.Context, groupName string) error {
-	result, err := store.db.ExecContext(ctx, `DELETE FROM groups WHERE name = $1`, groupName)
-	if err != nil {
-		return fmt.Errorf("failed to delete group: %w", err)
-	}
-	rows, err := result.RowsAffected()
-	if err != nil {
-		return fmt.Errorf("failed to get rows affected: %w", err)
-	}
-	if rows == 0 {
-		return credential.ErrGroupNotFound
-	}
-	return nil
-}
-
-func (store *PostgresStore) ListGroups(ctx context.Context) ([]string, error) {
-	rows, err := store.db.QueryContext(ctx, `SELECT name FROM groups ORDER BY name`)
-	if err != nil {
-		return nil, fmt.Errorf("failed to list groups: %w", err)
-	}
-	defer rows.Close()
-
-	var names []string
-	for rows.Next() {
-		var name string
-		if err := rows.Scan(&name); err != nil {
-			return nil, fmt.Errorf("failed to scan group name: %w", err)
-		}
-		names = append(names, name)
-	}
-	return names, rows.Err()
-}
-
-func (store *PostgresStore) UpdateGroup(ctx context.Context, group *iam_pb.Group) error {
-	if group == nil || group.Name == "" {
-		return fmt.Errorf("group name is required")
-	}
-	membersJSON, err := json.Marshal(group.Members)
-	if err != nil {
-		return fmt.Errorf("failed to marshal members: %w", err)
-	}
-	policyNamesJSON, err := json.Marshal(group.PolicyNames)
-	if err != nil {
-		return fmt.Errorf("failed to marshal policy_names: %w", err)
-	}
-
-	result, err := store.db.ExecContext(ctx,
-		`UPDATE groups SET members = $1, policy_names = $2, disabled = $3, updated_at = CURRENT_TIMESTAMP WHERE name = $4`,
-		membersJSON, policyNamesJSON, group.Disabled, group.Name)
-	if err != nil {
-		return fmt.Errorf("failed to update group: %w", err)
-	}
-	rows, err := result.RowsAffected()
-	if err != nil {
-		return fmt.Errorf("failed to get rows affected: %w", err)
-	}
-	if rows == 0 {
-		return credential.ErrGroupNotFound
-	}
-	return nil
-}