mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-08-16 12:16:36 +00:00
Chris LuandGitHub
2d9ea0285c
* s3: add the RenameObject endpoint
PUT /{bucket}/{key}?renameObject with x-amz-rename-source moves an object
through the filer's AtomicRenameEntry, so no bytes are read or rewritten and
the ETag, tags and SSE keys travel with the entry.
Only unversioned buckets: a versioned rename would have to rebuild the
.versions chain, and AWS offers RenameObject on directory buckets, which
cannot be versioned. The source arrives in a header, so it is authorized
separately for read and delete; both keys are locked, in key order, across the
precondition checks and the move.
* s3: let a matched source ETag precondition settle its date precondition
RFC 7232 has an ETag precondition outrank the date precondition on its own
side, and AWS documents the same for CopyObject: a matching
x-amz-copy-source-if-match with a failing x-amz-copy-source-if-unmodified-since
copies rather than returning 412. The source check evaluated all four headers in
sequence, so the date header could still veto a decided ETag match.
validateConditionalHeadersForReads already applies this precedence; the source
path now matches it.
* s3: cover a rename source named as a directory without a trailing slash
Renaming a directory would move a whole subtree, so it has to stay a missing
key whether or not the caller wrote the trailing slash.
* s3: accept a bare object key as the RenameObject source
AWS spells x-amz-rename-source both ways. Its CLI, Java and Rust examples pass
the bare source key, and only a second CLI example and the boto3 conditional
example pass bucket/key; the API reference's own example is a bare key too. The
header was read as bucket/key only, so the form AWS leads with was rejected with
InvalidArgument and the endpoint was unusable as documented.
A value is now read as a literal key first — the only reading that can never
name the wrong object — and as bucket-qualified second, when it carries the
request's own bucket and the literal key does not exist. That costs one extra
lookup only for a source that starts with the bucket's own name.
Another bucket's name in the source is no longer a distinct error: RenameObject
moves within one bucket, so it is simply part of a key this bucket does not
hold, and it reports NoSuchKey.
* s3: only a proven absence picks the other reading of a rename source
A source that resolves to a directory is not a miss to fall through on: the
literal path is still what the caller named, so answering for it beats renaming
a different object under the bucket-qualified reading. With a directory at
bucket/source.txt and an object at source.txt, a rename naming the former moved
the latter.
A failed lookup is not a proof of absence either, so a blip can no longer
redirect a rename to the other reading.
94 lines
2.8 KiB
Go
94 lines
2.8 KiB
Go
package s3api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestAuthorizeObjectDelete_AwsCanonicalPolicy: a policy granting s3:DeleteObject
|
|
// on <bucket>/* must allow per-key batch deletes. Pre-fix the bucket-level check
|
|
// built arn:aws:s3:::<bucket> and never matched the object-scoped policy.
|
|
func TestAuthorizeObjectDelete_AwsCanonicalPolicy(t *testing.T) {
|
|
const bucket = "test-bucket"
|
|
const policyName = "delete-test-bucket-objects"
|
|
|
|
policyDoc, err := json.Marshal(map[string]any{
|
|
"Version": "2012-10-17",
|
|
"Statement": []map[string]any{
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": "s3:DeleteObject",
|
|
"Resource": "arn:aws:s3:::" + bucket + "/*",
|
|
},
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
iam := &IdentityAccessManagement{
|
|
isAuthEnabled: true,
|
|
}
|
|
require.NoError(t, iam.PutPolicy(policyName, string(policyDoc)))
|
|
|
|
identity := &Identity{
|
|
Name: "alice",
|
|
Account: &AccountAdmin,
|
|
PolicyNames: []string{policyName},
|
|
Credentials: []*Credential{{AccessKey: "AKIAEXAMPLE", SecretKey: "secret"}},
|
|
}
|
|
|
|
r := httptest.NewRequest("POST", "/"+bucket+"?delete", nil)
|
|
|
|
require.Equal(t, s3err.ErrNone,
|
|
iam.AuthorizeObjectDelete(r, identity, bucket, "objects/a.txt", ""),
|
|
"s3:DeleteObject on arn:aws:s3:::%s/* must allow deleting %s/objects/a.txt", bucket, bucket)
|
|
|
|
require.Equal(t, s3err.ErrAccessDenied,
|
|
iam.AuthorizeObjectDelete(r, identity, "other-bucket", "objects/a.txt", ""),
|
|
"keys outside the granted bucket must be denied")
|
|
}
|
|
|
|
// TestAuthorizeObjectDelete_PrefixScopedPolicy: a prefix-scoped policy must allow
|
|
// batch deletes under the prefix and deny keys outside it, per-key.
|
|
func TestAuthorizeObjectDelete_PrefixScopedPolicy(t *testing.T) {
|
|
const bucket = "test-bucket"
|
|
const policyName = "delete-prefix-only"
|
|
|
|
policyDoc, err := json.Marshal(map[string]any{
|
|
"Version": "2012-10-17",
|
|
"Statement": []map[string]any{
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": "s3:DeleteObject",
|
|
"Resource": "arn:aws:s3:::" + bucket + "/safe/*",
|
|
},
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
iam := &IdentityAccessManagement{
|
|
isAuthEnabled: true,
|
|
}
|
|
require.NoError(t, iam.PutPolicy(policyName, string(policyDoc)))
|
|
|
|
identity := &Identity{
|
|
Name: "alice",
|
|
Account: &AccountAdmin,
|
|
PolicyNames: []string{policyName},
|
|
Credentials: []*Credential{{AccessKey: "AKIAEXAMPLE", SecretKey: "secret"}},
|
|
}
|
|
|
|
r := httptest.NewRequest("POST", "/"+bucket+"?delete", nil)
|
|
|
|
require.Equal(t, s3err.ErrNone,
|
|
iam.AuthorizeObjectDelete(r, identity, bucket, "safe/inside.txt", ""),
|
|
"key under granted prefix must be allowed")
|
|
|
|
require.Equal(t, s3err.ErrAccessDenied,
|
|
iam.AuthorizeObjectDelete(r, identity, bucket, "danger/outside.txt", ""),
|
|
"key outside the granted prefix must be denied per-key, not at the batch level")
|
|
}
|