mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-08-16 20:26:45 +00:00
Chris LuandGitHub
10e7f0f2bc
* fix(shell): s3.user.provision handles existing users by attaching policy Instead of erroring when the user already exists, the command now creates the policy and attaches it to the existing user via UpdateUser. Credentials are only generated and displayed for newly created users. * fix(shell): skip duplicate policy attachment in s3.user.provision Check if the policy is already attached before appending and calling UpdateUser, making repeated runs idempotent. * fix(shell): generate service account ID in s3.serviceaccount.create The command built a ServiceAccount proto without setting Id, which was rejected by credential.ValidateServiceAccountId on any real store. Now generates sa:<parent>:<uuid> matching the format used by the admin UI. * test(s3): integration tests for s3.* shell commands Adds TestShell* integration tests covering ~40 previously untested shell commands: user, accesskey, group, serviceaccount, anonymous, bucket, policy.attach/detach, config.show, and iam.export/import. Switches the test cluster's credential store from memory to filer_etc because the memory store silently drops groups and service accounts in LoadConfiguration/SaveConfiguration. * fix(shell): rollback policy on key generation failure in s3.user.provision If iam.GenerateRandomString or iam.GenerateSecretAccessKey fails after the policy was persisted, the policy would be left orphaned. Extracts the rollback logic into a local closure and invokes it on all failure paths after policy creation for consistency. * address PR review feedback for s3 shell tests and serviceaccount - s3.serviceaccount.create: use 16 bytes of randomness (hex-encoded) for the service account UUID instead of 4 bytes to eliminate collision risk - s3.serviceaccount.create: print the actual ID and drop the outdated "server-assigned" note (the ID is now client-generated) - tests: guard createdAK in accesskey rotate/delete subtests so sibling failures don't run invalid CLI calls - tests: requireContains/requireNotContains use t.Fatalf to fail fast - tests: Provision subtest asserts the "Attached policy" message on the second provision call for an existing user - tests: update extractServiceAccountID comment example to match the sa:<parent>:<uuid> format - tests: drop redundant saID empty-check (extractServiceAccountID fatals) * test(s3): use t.Fatalf for precondition check in serviceaccount test
74 lines
2.3 KiB
Go
74 lines
2.3 KiB
Go
package policy
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// requireContains fails the test if substr is not found in output.
|
|
func requireContains(t *testing.T, output, substr, context string) {
|
|
t.Helper()
|
|
if !strings.Contains(output, substr) {
|
|
t.Fatalf("%s: expected output to contain %q\n--- output ---\n%s\n--- end ---", context, substr, output)
|
|
}
|
|
}
|
|
|
|
// requireNotContains fails the test if substr IS found in output.
|
|
func requireNotContains(t *testing.T, output, substr, context string) {
|
|
t.Helper()
|
|
if strings.Contains(output, substr) {
|
|
t.Fatalf("%s: expected output to NOT contain %q\n--- output ---\n%s\n--- end ---", context, substr, output)
|
|
}
|
|
}
|
|
|
|
// extractFieldAfter returns the first occurrence of the value after a "Prefix: " line.
|
|
// Example: extractFieldAfter(out, "Access Key:") -> "AKIAXXXX..."
|
|
// Returns "" if not found.
|
|
func extractFieldAfter(output, prefix string) string {
|
|
for _, line := range strings.Split(output, "\n") {
|
|
line = strings.TrimSpace(line)
|
|
if strings.HasPrefix(line, prefix) {
|
|
return strings.TrimSpace(strings.TrimPrefix(line, prefix))
|
|
}
|
|
}
|
|
return ""
|
|
}
|
|
|
|
// splitLines splits output into trimmed non-empty lines.
|
|
func splitLines(output string) []string {
|
|
var lines []string
|
|
for _, line := range strings.Split(output, "\n") {
|
|
if trimmed := strings.TrimSpace(line); trimmed != "" {
|
|
lines = append(lines, trimmed)
|
|
}
|
|
}
|
|
return lines
|
|
}
|
|
|
|
// fieldsOf splits a line on whitespace.
|
|
func fieldsOf(line string) []string {
|
|
return strings.Fields(line)
|
|
}
|
|
|
|
// extractServiceAccountID parses the tab-separated output of `s3.serviceaccount.list`
|
|
// and returns the ID of the first row whose PARENT column matches parentUser.
|
|
// The list output format is:
|
|
//
|
|
// ID PARENT STATUS DESCRIPTION
|
|
// sa:user-yyy:a1b2c3d4e5f6... user-yyy enabled some desc
|
|
func extractServiceAccountID(t *testing.T, listOutput, parentUser string) string {
|
|
t.Helper()
|
|
for _, line := range strings.Split(listOutput, "\n") {
|
|
line = strings.TrimSpace(line)
|
|
if line == "" || strings.HasPrefix(line, "ID") || strings.HasPrefix(line, "No service accounts") {
|
|
continue
|
|
}
|
|
fields := strings.Fields(line)
|
|
if len(fields) >= 2 && fields[1] == parentUser {
|
|
return fields[0]
|
|
}
|
|
}
|
|
t.Fatalf("could not find service account with parent=%q in output:\n%s", parentUser, listOutput)
|
|
return ""
|
|
}
|